CVE-2024-32475

score

<0.1

cvss

7.5

epss

0.7%

published

2024-04-18

kev added

—

first seen

2026-10-21

Envoy versions prior to 1.30.1, 1.29.4, 1.28.3, and 1.27.5 contain a vulnerability caused by not handling errors when setting SNI for outbound TLS connections with long host/authority headers, letting attackers trigger process termination, exploit requires sending a request with a host/authority header longer than 255 characters.