{
  "cveId": "CVE-2024-32475",
  "url": "https://patchblox.com/security/cve/CVE-2024-32475",
  "summary": "CVE-2024-32475 is fixed in ecs-service-connect-agent on 1 platform by ALAS2023-2024-647 (version v1.29.5.0-1.amzn2023), released June 19, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ecs-service-connect-agent: Envoy is a cloud-native, open source edge and service proxy",
  "description": "Envoy is a cloud-native, open source edge and service proxy. When an upstream TLS cluster is used with \u0060auto_sni\u0060 enabled, a request containing a \u0060host\u0060/\u0060:authority\u0060 header longer than 255 characters triggers an abnormal termination of Envoy process. Envoy does not gracefully handle an error when setting SNI for outbound TLS connection. The error can occur when Envoy attempts to use the \u0060host\u0060/\u0060:authority\u0060 header value longer than 255 characters as SNI for outbound TLS connection. SNI length is limited to 255 characters per the standard. Envoy always expects this operation to succeed and abnormally aborts the process when it fails. This vulnerability is fixed in 1.30.1, 1.29.4, 1.28.3, and 1.27.5.",
  "published": "2024-06-19T21:09:00Z",
  "severity": "important",
  "epss": 0.00679,
  "epssPercentile": 0.52807,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ecs-service-connect-agent",
      "release": "amzn 2023",
      "fixedVersion": "v1.29.5.0-1.amzn2023",
      "fix": "ALAS2023-2024-647",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2024-647",
      "released": "2024-06-19T21:09:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T13:47:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}