CVE-2024-45807 in Envoy
Summary
by MITRE • 09/20/2024
Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the `oghttp2` by default. The impact of this issue is that envoy will crash. This issue has been addressed in release version 1.31.2. All users are advised to upgrade. There are no known workarounds for this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/10/2026
The vulnerability identified as CVE-2024-45807 affects Envoy, a widely adopted cloud-native high-performance edge/middle/service proxy that serves as a critical component in modern microservices architectures and service mesh deployments. This issue specifically targets Envoy's HTTP/2 codec implementation, where the default `oghttp2` codec contains fundamental stream management bugs that can lead to system instability. The vulnerability manifests in environments where Envoy is processing HTTP/2 traffic, particularly when handling concurrent streams or complex request/response patterns that stress the underlying codec implementation. Organizations relying on Envoy for their service mesh infrastructure, API gateways, or edge computing deployments face significant operational risks from this flaw.
The technical flaw resides in the stream management mechanisms of the `oghttp2` codec implementation within Envoy's 1.31 release. When processing HTTP/2 streams, the codec encounters race conditions or memory management issues that result in undefined behavior and ultimately lead to process crashes. This type of vulnerability falls under CWE-674, which describes "Uncontrolled Recursion" and related issues in resource management, or potentially CWE-129, "Improper Validation of Array Index," depending on the specific implementation details. The stream management bugs likely involve improper handling of stream lifecycle events, concurrent access to shared resources, or memory deallocation issues that occur when multiple HTTP/2 streams are processed simultaneously.
The operational impact of this vulnerability is severe for organizations utilizing Envoy in production environments, as it directly compromises system stability and availability. When the `oghttp2` codec encounters problematic stream patterns, Envoy instances will crash and restart, potentially leading to service disruption, increased latency, and potential denial of service conditions for downstream applications. This issue affects the core functionality of Envoy's proxy capabilities, making it particularly dangerous in high-throughput environments where HTTP/2 traffic is prevalent. The crash behavior can also result in loss of connection state, incomplete request processing, and potential data integrity issues in distributed systems that depend on Envoy's reliable proxying capabilities.
Organizations should immediately upgrade to Envoy version 1.31.2 to remediate this vulnerability, as no effective workarounds exist for this specific issue. The fix implemented in version 1.31.2 involves disabling the problematic `oghttp2` codec by default, which prevents the stream management bugs from manifesting. This remediation aligns with ATT&CK technique T1595.001, "Network Denial of Service," as the vulnerability can be exploited to cause service disruption through process crashes, though it's more accurately classified as a software reliability issue. Security teams should conduct thorough testing of their Envoy deployments after upgrading to ensure that the default codec change does not introduce unexpected behavior in their specific operational contexts, particularly in environments that may have been relying on the `oghttp2` codec for specific performance characteristics or compatibility requirements. The vulnerability demonstrates the critical importance of maintaining up-to-date proxy software in cloud-native environments where service reliability directly impacts business operations.