5.7 Medium

CVE-2024-34364 Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response

Description

Envoy is a cloud-native, open source edge and service proxy. Envoy exposed an out-of-memory (OOM) vector from the mirror response, since async HTTP client will buffer the response with an unbounded buffer.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Exploitable remotely over the network, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: Low
Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
envoy 1.30	1.30.0 → 1.30.1	No fix stated
envoy 1.29	1.29.0 → 1.29.4	No fix stated
envoy 1.28	1.28.0 → 1.28.3	No fix stated
envoy 1.27	earliest → 1.27.5	No fix stated

References

github.com github.com

Timeline

Published June 4, 2024
Last modified November 5, 2026

The 98 CVEs of envoy →

CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 High CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 High

Track this CVE