BIT-envoy-2024-32976

vendorUSosv

Envoy can enter an endless loop while decompressing Brotli data with extra input

view advisory published 2024-06-06Licence: per source

Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-32976US	high7.5	0.68% (52nd)	—	2024-06-04
Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.

references

External citations — patches, advisories, analysis.

https://github.com/envoyproxy/envoy/security/advisories/GHSA-7wp5-c2vq-4f8mADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-32976WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan