7.5 High

CVE-2024-32976 Envoy can enter an endless loop while decompressing Brotli data with extra input

Description

Envoy is a cloud-native, open source edge and service proxy. Envoyproxy with a Brotli filter can get into an endless loop during decompression of Brotli data with extra input.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Affected products and versions

Product	Affected versions	Fixed in
envoy 1.30	1.30.0 → 1.30.1	No fix stated
envoy 1.29	1.29.0 → 1.29.4	No fix stated
envoy 1.28	1.28.0 → 1.28.3	No fix stated
envoy 1.18	1.18.0 → 1.27.5	No fix stated

References

github.com github.com

Timeline

Published June 4, 2024
Last modified November 5, 2026

The 98 CVEs of envoy →

CVE-2026-73511 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73553 Envoy is an open source edge and service proxy designed for cloud-native applications 7.5 High CVE-2026-73551 Envoy is an open source edge and service proxy designed for cloud-native applications 5.3 Medium CVE-2026-73546 Envoy is an open source edge and service proxy designed for cloud-native applications 7.4 High

Track this CVE