Loading vulnerability…
Crash in Envoy HTTP Async Client via sendLocalReply
A vulnerability in Envoy's HTTP async client allows a crash when handling sendLocalReply under certain conditions, such as websocket upgrades and request mirroring. The issue arises due to improper lifecycle management: the stream decoder may be destroyed while still referenced in router.onDestroy(), leading to a segmentation fault. This impacts features like ext_authz when upgrade and connection headers are allowed, as well as request mirroring.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation leads to a crash (segmentation fault) of the Envoy process, resulting in a denial of service. This can be triggered by specific HTTP request patterns involving websocket upgrades or request mirroring, potentially allowing an attacker to disrupt service availability.
If you can’t patch tonight, do this now.
There are no known workarounds. Users should upgrade to a patched version as soon as possible to mitigate the risk.
Patch, then assume compromise.
Upgrade Envoy to one of the fixed versions: 1.31.2, 1.30.6, 1.29.9, or 1.28.7. These versions address the improper lifecycle management in the HTTP async client.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.