Loading vulnerability…
Envoy auto_sni authority header denial of service
CVE-2024-32475 is an abnormal-termination vulnerability in Envoy's outbound TLS SNI handling. When an upstream TLS cluster has auto_sni enabled, Envoy uses the incoming Host or :authority header as the SNI value for the upstream connection. An authority value exceeding the SNI standard's 255-character limit causes SNI configuration to fail. Envoy incorrectly assumes this operation succeeds and aborts rather than handling the error gracefully.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can terminate the Envoy process, causing denial of service for traffic handled by the affected proxy instance. In a deployment without effective process supervision, redundancy, or rapid restart behavior, this can produce sustained service disruption.
If you can’t patch tonight, do this now.
As an interim mitigation, disable auto_sni on upstream TLS clusters or implement request filtering to reject requests with host or :authority headers longer than 255 characters until the software can be upgraded.
Patch, then assume compromise.
Upgrade Envoy to a fixed release: 1.30.1, 1.29.4, 1.28.3, or 1.27.5, or later versions in the respective supported release lines. For Red Hat OpenShift Service Mesh, apply the applicable security update that includes the corrected Envoy build.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.