CVE-2024-39305

score

<0.1

cvss

6.5

epss

0.6%

published

2024-07-01

kev added

—

first seen

2026-10-21

Envoy versions before 1.30.4, 1.29.7, 1.28.5, and 1.27.7 contain a use-after-free caused by referencing freed memory when route hash policy is configured with cookie attributes, letting attackers cause process termination or memory disclosure, exploit requires configuration with cookie attributes.