Database/Container, Kubernetes & orchestration

Envoy: uncaught exception serializing incomplete UTF-8 strings crashes the proxy

CVSS 7.5CVE-2024-34363Container, Kubernetes & orchestrationcurated

Impact

Envoy invoked the nlohmann JSON library in a way that let an uncaught exception escape when incomplete UTF-8 strings from downstream data were serialized, terminating the process. Any Envoy that serializes request-derived strings to JSON - access logging, ext_proc, ext_authz, RBAC or rate-limit paths - can be crashed by a client sending malformed UTF-8. For a GPU cluster where Envoy is the ingress to model-serving pods, this is an unauthenticated remote kill switch on the whole data path, and the trigger is a single short request rather than sustained load. Record states availability impact only.

Who can reach it

Any client that can send a request containing malformed UTF-8 to an Envoy listener whose configuration serializes that data to JSON. No authentication needed on an open ingress.

What to do

Upgrade Envoy to a release carrying the fix from GHSA-g979-ph9j-5gg4 and restart the proxy fleet - rolling restart of gateways and sidecars, no host reboot. No reliable configuration-only mitigation is named in the advisory record, so patching is the action. GPU nodes do not need draining.

References

https://nvd.nist.gov/vuln/detail/CVE-2024-34363 https://github.com/envoyproxy/envoy/security/advisories/GHSA-g979-ph9j-5gg4

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.