CVE-2024-23322: 
NixOS vulnerability analysis and mitigation

CVE-2024-23322 affects Envoy, a high-performance edge/middle/service proxy. The vulnerability was discovered and disclosed on February 9, 2024, and has been addressed in releases 1.29.1, 1.28.1, 1.27.3, and 1.26.7. The issue affects all versions from 1.26.0 up to (excluding) 1.29.1 (NVD, GitHub Advisory).

The vulnerability is classified as a Use After Free (CWE-416) issue with a CVSS v3.1 Base Score of 7.5 (HIGH). The crash occurs when three specific conditions are met simultaneously: 1) hedge_on_per_try_timeout is enabled, 2) per_try_idle_timeout is enabled (only possible through configuration), and 3) per-try-timeout is enabled (through headers or configuration) with a value equal to or within the backoff interval of the per_try_idle_timeout (GitHub Advisory).

The vulnerability results in a Denial of Service (DoS) condition when exploited. The CVSS metrics indicate that while there are no confidentiality or integrity impacts, the availability impact is rated as High, potentially causing a complete denial of service to the affected component (GitHub Advisory).

The issue has been patched in versions 1.29.1, 1.28.1, 1.27.3, and 1.26.7. Users are advised to upgrade to these or newer versions. There are no known workarounds for this vulnerability (NVD).