CVE-2024-53270

score

<0.1

cvss

7.5

epss

0.7%

published

2024-12-18

kev added

—

first seen

2026-10-21

Envoy versions 1.29.12, 1.30.9, 1.31.5, and 1.32.3 contain a null pointer dereference caused by assuming active request exists when it may be nullptr in certain load shedding configurations, leading to potential crashes, exploit requires specific load shed point configuration.