BIT-ENVOY-2024-23326

BIT-ENVOY-2024-23326 PUBLISHED CVSS 5.900000095367432 MEDIUM

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.

Risk Scores

CVSS v3.1

5.900000095367432

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Products

Vendor	Product	Versions
envoyproxy	envoy	>= 1.13.0, <= 1.30.1, >= 1.29.0, <= 1.29.4, >= 1.28.0, <= 1.28.3

Exploit Intelligence

https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c (circl)
CIRCL seen: CVE-2024-23326 (circl-sighting)

Timeline

Jun 4, 2024 CVE Published
Jul 25, 2025 PoC Published

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c url

Open in Interactive Console →