CVE-2024-45810

score

<0.1

cvss

6.5

epss

0.6%

published

2024-09-20

kev added

—

first seen

2026-10-21

Envoy versions prior to 1.28.7, 1.29.9, 1.30.6, and 1.31.2 contain a crash caused by improper handling of sendLocalReply in the HTTP async client during websocket upgrades and request mirroring, leading to segmentation faults, exploit requires specific request headers and mirroring.