CVE-2024-23326

Description

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.

CVSS v3.1 Score

5.9

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

CWE-391 CWE-391

CWE-444 CWE-444

Affected Products

Vendor	Product	Versions
envoyproxy	envoy	< 1.27.6
envoyproxy	envoy	1.28.0 — 1.28.4
envoyproxy	envoy	1.29.0 — 1.29.5
envoyproxy	envoy	1.30.0 — 1.30.2

References

Advisories & Patches

https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c

Frequently Asked Questions

What is CVE-2024-23326? +

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response. It has a CVSS v3.1 base score of 5.9 (MEDIUM).

How severe is CVE-2024-23326? +

CVE-2024-23326 has a CVSS v3.1 score of 5.9 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-23326? +

CVE-2024-23326 affects products from envoyproxy, specifically: envoy. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-23326? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-52316 9.8

Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext …

CVE-2025-71325 9.8

picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments …

CVE-2022-20849 6.1

A vulnerability in the Broadband Network Gateway PPP over Ethernet (PPPoE) feature of Cisco IOS XR Software could allow an unauthenticated, …

CVE-2023-32871 5.3

In DA, there is a possible permission bypass due to an incorrect status check. This could lead to local escalation …

CVE-2024-23324 8.6

Envoy is a high-performance edge/middle/service proxy. External authentication can be bypassed by downstream connections. Downstream clients can force invalid gRPC …

CVE-2024-45807 7.5

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using `oghttp` as the default HTTP/2 codec, and there are …