Envoy: integer underflow in the QUIC stream sequencer buffer crashes the proxy

Impact

A separate QUIC defect from the use-after-free in the same advisory batch: an integer underflow in QuicStreamSequencerBuffer::PeekRegion leads to a crash in QuicheDataReader::PeekVarInt62Length(). Where Envoy is the ingress or the sidecar in front of inference services, an unauthenticated remote client can terminate the proxy process and take down every route it serves until it restarts, and a crash loop under sustained traffic means the outage persists. Confidentiality and integrity are unaffected per the record. Exposure is limited to deployments with QUIC/HTTP3 listeners enabled.

Who can reach it

Any unauthenticated client able to reach an Envoy QUIC/HTTP3 listener. No credentials required.

What to do

Upgrade Envoy to a release carrying the fix from GHSA-g9mq-6v96-cpqc and restart the proxy fleet - a rolling data-plane restart for sidecars, a rolling deployment restart for gateways. Disabling QUIC listeners is an available interim mitigation. No GPU node drain or reboot.

References

Related entries

• Envoy: Brotli decompression of data with extra input loops endlessly and hangs the workerCVE-2024-32976 · Envoy (Brotli decompressor filter)High
• Envoy: uncaught exception serializing incomplete UTF-8 strings crashes the proxyCVE-2024-34363 · Envoy (nlohmann JSON serialization of downstream data)High
• Traefik: IP allow-lists bypassed via HTTP/3 early data in QUIC 0-RTT with spoofed addressesCVE-2024-39321 · TraefikHigh
• Argo CD: Large JSON payload to /api/webhook DoSes the API server from an unauthenticated positionCVE-2024-40634 · Argo CDHigh
• Envoy: Stream-management bugs in the default oghttp HTTP/2 codecCVE-2024-45807 · EnvoyHigh
• Envoy: Load-shed path assumes an active request existsCVE-2024-53270 · EnvoyHigh