Read the docs
TI-2024-26262 Aliases CVE-2024-39305

Envoy Proxy use after free when route hash policy is configured with cookie attributes

Priority MEDIUM 46CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be immediately apparent if it was configured. Memory allocated for holding attribute values is freed after configuration was parsed. During request processing Envoy will attempt to copy content of de-allocated memory into request cookie header. This can lead to arbitrary content of Envoy's memory to be sent to the upstream service or abnormal process termination. This vulnerability is fixed in Envoy versions v1.30.4, v1.29.7, v1.28.5, and v1.27.7. As a workaround, do not use cookie attributes in route action hash policy.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00647 51st percentileScored 2026-11-07
Fix Fixed envoy (envoyproxy): 1.30.4, 1.29.7, 1.28.5 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
envoyproxyenvoy1.30.0 to before 1.30.4; 1.29.0 to before 1.29.7; 1.28.0 to before 1.28.5; before 1.27.71.30.4, 1.29.7, 1.28.5, 1.27.7Patch availableCNA
  • envoy Vendorenvoyproxy Affected 1.30.0 to before 1.30.4; 1.29.0 to before 1.29.7; 1.28.0 to before 1.28.5; before 1.27.7 Fixed in 1.30.4, 1.29.7, 1.28.5, 1.27.7 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:envoyproxy:envoy:1.27.6:*:*:*:*:*:*:*1.27.6Vulnerableenvoyproxy
cpe:2.3:a:envoyproxy:envoy:1.28.4:*:*:*:*:*:*:*1.28.4Vulnerableenvoyproxy
cpe:2.3:a:envoyproxy:envoy:1.29.6:*:*:*:*:*:*:*1.29.6Vulnerableenvoyproxy
cpe:2.3:a:envoyproxy:envoy:1.30.3:*:*:*:*:*:*:*1.30.3Vulnerableenvoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.27.6:*:*:*:*:*:*:* Versions 1.27.6 Vulnerable ·envoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.28.4:*:*:*:*:*:*:* Versions 1.28.4 Vulnerable ·envoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.29.6:*:*:*:*:*:*:* Versions 1.29.6 Vulnerable ·envoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.30.3:*:*:*:*:*:*:* Versions 1.30.3 Vulnerable ·envoyproxy

Remediation

  • Fix · CNA envoy (envoyproxy) Fixed in 1.30.4, 1.29.7, 1.28.5, 1.27.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-39305
  2. 2026-10-19 EPSS moved to the 50th–90th percentile

References

Patch 4

Advisory 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-20001 HTTP/2: CPU exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
  • TI-2024-18524 HTTP/2: memory exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
  • TI-2023-12215 Envoy client may fake the header `x-envoy-original-path` CVSS 3.1CRITICAL 9.1
  • TI-2023-18002 Envoy vulnerable to OAuth2 credentials exploit with permanent validity CVSS 3.1CRITICAL 9.8
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences