CVE-2024-23326

Envoy incorrectly accepts HTTP 200 response for entering upgrade mode

State: Published
Severity: 5.9 Medium
Published: Jun 4, 2024
Updated: Aug 1, 2024
Reserved: Jan 15, 2024

Description

Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into adding an upgrade header into a response. Per RFC https://www.rfc-editor.org/rfc/rfc7230#section-6.7 a server sends 101 when switching protocols. Envoy incorrectly accepts a 200 response from a server when requesting a protocol upgrade, but 200 does not indicate protocol switch. This opens up the possibility of request smuggling through Envoy if the server can be tricked into adding the upgrade header to the response.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-391 Unchecked Error Condition

Affected Products

Product	Versions
envoyenvoyproxy	>= 1.13.0, <= 1.30.1Affected >= 1.29.0, <= 1.29.4Affected >= 1.28.0, <= 1.28.3Affected <= 1.27.5Affected

References

https://github.com/envoyproxy/envoy/security/advisories/GHSA-vcf8-7238-v74c

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.