CVE-2024-34363: Envoyproxy Envoy DOS Vulnerability

CVE-2024-34363 Overview

CVE-2024-34363 affects Envoy, a cloud-native open source edge and service proxy widely deployed in service mesh and API gateway architectures. The vulnerability exists in how Envoy invokes the nlohmann JSON library. When incomplete UTF-8 strings are serialized, the library throws an uncaught exception from downstream data. This uncaught exception causes the Envoy process to crash, producing a denial of service condition. The flaw is categorized under [CWE-248] Uncaught Exception and is remotely reachable without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can crash Envoy proxy instances by sending crafted downstream data containing incomplete UTF-8 strings, disrupting all services routed through the affected proxy.

Affected Products

Envoyproxy Envoy (multiple versions prior to fixed releases)
Deployments using Envoy for edge proxy, ingress, or service mesh data plane
Kubernetes environments running Envoy-based ingress controllers or sidecars

Discovery Timeline

2024-06-04 - CVE-2024-34363 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34363

Vulnerability Analysis

Envoy uses the nlohmann JSON library to serialize data for logging, administrative endpoints, and other outputs. The library requires valid UTF-8 encoded strings during serialization. When Envoy passes strings containing incomplete or malformed UTF-8 byte sequences, the library raises a C++ exception. Envoy does not wrap these serialization calls in appropriate exception handlers. The exception propagates upward without being caught, terminating the Envoy process.

The vulnerability affects availability but not confidentiality or integrity. It maps to [CWE-248] Uncaught Exception. The EPSS score is 0.674% with a percentile of 47.5, reflecting moderate exploitation probability. No public proof-of-concept exploit has been published, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing exception handling around calls into the nlohmann JSON library. The library enforces strict UTF-8 validation during serialization and throws when it encounters invalid byte sequences. Envoy passes downstream-controlled data into these serialization paths without first validating the encoding or catching potential exceptions at the call site.

Attack Vector

An attacker sends downstream traffic containing headers, body content, or other fields carrying incomplete UTF-8 byte sequences. When Envoy serializes this data through code paths that invoke the JSON library, the uncaught exception terminates the proxy. This affects all clients and upstream services depending on the crashed instance until it restarts.

Because the attack requires no authentication and can be triggered remotely over the network, any Envoy instance accepting downstream traffic from untrusted sources is exposed. See the GitHub Security Advisory GHSA-g979-ph9j-5gg4 for the vendor description.

Detection Methods for CVE-2024-34363

Indicators of Compromise

Repeated Envoy process crashes or unexpected restarts logged by the supervising orchestrator such as Kubernetes, systemd, or the Envoy hot restarter.
Log entries showing uncaught C++ exceptions referencing nlohmann JSON serialization prior to process termination.
Sudden drops in upstream request success rates coinciding with proxy restart events.

Detection Strategies

Monitor Envoy admin /stats endpoint for server.live transitions and server.hot_restart_epoch increments indicating unplanned restarts.
Alert on container restart counters and pod restart events for workloads running Envoy or Envoy-based ingress controllers.
Inspect access logs for downstream requests that contain non-UTF-8 byte sequences in headers, paths, or bodies immediately preceding crashes.

Monitoring Recommendations

Ingest Envoy stderr and stdout into a centralized log pipeline to capture exception traces before container termination.
Track request-to-crash correlation using distributed tracing to identify the exact downstream payload triggering the fault.
Baseline normal restart frequency and alert on statistically significant deviations across the fleet.

How to Mitigate CVE-2024-34363

Immediate Actions Required

Upgrade Envoy to a patched release listed in the GitHub Security Advisory GHSA-g979-ph9j-5gg4.
Inventory all Envoy deployments including standalone proxies, service mesh data planes such as Istio and Consul, and API gateways built on Envoy.
Restrict untrusted downstream access to Envoy endpoints where feasible until patches are applied.

Patch Information

The Envoy maintainers released fixed versions addressing the uncaught exception through the security advisory GHSA-g979-ph9j-5gg4. Consult the advisory for the specific patched version numbers that match your deployed release train. Downstream distributions including Istio and cloud-managed service meshes have published corresponding updates.

Workarounds

Deploy Envoy behind an upstream filter or WAF that rejects requests containing invalid UTF-8 byte sequences in headers and body content.
Configure aggressive process supervision to minimize downtime during crash and restart cycles until patching is complete.
Disable or restrict access to Envoy features that invoke JSON serialization on untrusted downstream data, such as verbose access logging with JSON formatters, where operationally acceptable.