CVE-2024-23325

    Dashboard / Vulnerabilities / CVE-2024-23325

    CVE-2024-23325

    Published: 9 Feb 2024Last Modified: 28 Oct 2026

    Summary: Envoy crashes when using an address type that isn’t supported by the OS

    Details: Envoy is a high-performance edge/middle/service proxy. Envoy crashes in Proxy protocol when using an address type that isn’t supported by the OS. Envoy is susceptible to crashing on a host with IPv6 disabled and a listener config with proxy protocol enabled when it receives a request where the client presents its IPv6 address. It is valid for a client to present its IPv6 address to a target server even though the whole chain is connected via IPv4. This issue has been addressed in released 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23325.json, https://github.com/envoyproxy/envoy/security/advisories/GHSA-5m7c-mrwr-pm26, https://nvd.nist.gov/vuln/detail/CVE-2024-23325, https://github.com/envoyproxy/envoy/commit/bacd3107455b8d387889467725eb72aa0d5b5237

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 51964702956d64adcd1df6b8ea132e863fe78e74
    Fixed -a0e580408ef4568b0a16c6663b6d8ae0c46aba6a

    Affected versions

    v1.29.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High