Vandycknick

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.28.7 Envoy versions prior to 1.29.9 Envoy versions prior to 1.30.6 Envoy versions prior to 1.31.2 Description: Envoy is a cloud-native high-performance edge/middle/service proxy. The http async client will crash when handling `sendLocalReply` under certain circumstances, such as websocket upgrade and requests mirroring. This occurs due to the duplication of the status code and the destruction of the router being called at the destructor of the async stream. The stream decoder is destroyed, but its reference is called in `router.onDestroy()`, causing a segment fault. This issue impacts ext authz if the `upgrade` and `connection` header are allowed, and request mirroring. Recommendations: For Envoy versions prior to 1.28.7, upgrade to version 1.28.7 or later. For Envoy versions prior to 1.29.9, upgrade to version 1.29.9 or later. For Envoy versions prior to 1.30.6, upgrade to version 1.30.6 or later. For Envoy versions prior to 1.31.2, upgrade to version 1.31.2 or later.