CVE-2024-32475

Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with `auto_sni` enabled, a request containing a `host`/`:authority` header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the `host`/`:authority` header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails. This vulnerability is fixed in 1.30.1, 1.29.4, 1.28.3, and 1.27.5.

• CWE-253
• CWE-617

• https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382Patch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wjPatch, Vendor Advisory
• https://github.com/envoyproxy/envoy/commit/b47fc6648d7c2dfe0093a601d44cb704b7bad382Patch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-3mh5-6q8v-25wjPatch, Vendor Advisory

Published

Apr 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32469Decidim is a participatory democracy framework. The paginati…7.1
• CVE-2024-3247In Xpdf 4.05 (and earlier), a PDF object loop in an object s…5.5
• CVE-2024-32470Tolgee is an open-source localization platform. When API key…6.5
• CVE-2024-32472excalidraw is an open source virtual hand-drawn style whiteb…6.1
• CVE-2024-32473Moby is an open source container framework that is a key com…6.5
• CVE-2024-32474Sentry is an error tracking and performance monitoring platf…6.5
• CVE-2024-32476Argo CD is a declarative, GitOps continuous delivery tool fo…6.5
• CVE-2024-32477Deno is a JavaScript, TypeScript, and WebAssembly runtime wi…7.4
• CVE-2024-32478Git Credential Manager (GCM) is a secure Git credential help…6.9
• CVE-2024-32479LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…5.4
• CVE-2024-3248In Xpdf 4.05 (and earlier), a PDF object loop in the attachm…5.5
• CVE-2024-32480LibreNMS is an open-source, PHP/MySQL/SNMP-based network mon…7.2