{
  "cveId": "CVE-2024-32974",
  "url": "https://patchblox.com/security/cve/CVE-2024-32974",
  "summary": "CVE-2024-32974 is fixed in ecs-service-connect-agent on 1 platform by ALAS2023-2024-647 (version v1.29.5.0-1.amzn2023), released June 19, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ecs-service-connect-agent: Envoy is a cloud-native, open source edge and service proxy",
  "description": "Envoy is a cloud-native, open source edge and service proxy. A crash was observed in \u0060EnvoyQuicServerStream::OnInitialHeadersComplete()\u0060 with following call stack. It is a use-after-free caused by QUICHE continuing push request headers after \u0060StopReading()\u0060 being called on the stream. As after \u0060StopReading()\u0060, the HCM\u0027s \u0060ActiveStream\u0060 might have already be destroyed and any up calls from QUICHE could potentially cause use after free.",
  "published": "2024-06-19T21:09:00Z",
  "severity": "important",
  "epss": 0.00693,
  "epssPercentile": 0.5335,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ecs-service-connect-agent",
      "release": "amzn 2023",
      "fixedVersion": "v1.29.5.0-1.amzn2023",
      "fix": "ALAS2023-2024-647",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2024-647",
      "released": "2024-06-19T21:09:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T13:47:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}