Envoy Addresses High CPU Usage and Increased Request Latency Issue with Regular Expressions
CVE-2024-23323

5.3MEDIUM

Key Information:

Vendor

envoyproxy

Status
envoy
Vendor
CVE Published:
9 February 2024

What is CVE-2024-23323?

Envoy is a high-performance edge/middle/service proxy. The regex expression is compiled for every request and can result in high CPU usage and increased request latency when multiple routes are configured with such matchers. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected Version(s)

envoy >= 1.29.0, < 1.29.1 < 1.29.0, 1.29.1

envoy >= 1.28.0, < 1.28.1 < 1.28.0, 1.28.1

envoy >= 1.27.0, < 1.27.3 < 1.27.0, 1.27.3

References

https://github.com/envoyproxy/envoy/security/advisories/G...
x_refsource_CONFIRM
https://github.com/envoyproxy/envoy/commit/71eeee8f0f0132...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.