Loading vulnerability…
HTTP/2 CONTINUATION Frame Flood CPU Exhaustion in Envoy
CVE-2024-30255 is a resource-exhaustion vulnerability in Envoy's HTTP/2 protocol stack, affecting releases before the branch-specific fixes in versions 1.29.3, 1.28.2, 1.27.4, and 1.26.8. The HTTP/2 codec accepts an unlimited number of CONTINUATION frames even after configured header map limits have been exceeded. An attacker can send a continuous sequence of these frames without setting END_HEADERS, forcing sustained processing and causing denial of service through CPU exhaustion.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation consumes approximately one CPU core per 300 Mbit/s of attack traffic. Sustained flooding can exhaust available CPU capacity and deny service to legitimate clients of the affected Envoy deployment.
If you can’t patch tonight, do this now.
Disable HTTP/2 for downstream connections until a fixed Envoy release can be deployed.
Patch, then assume compromise.
Upgrade Envoy to the applicable fixed release: 1.29.3, 1.28.2, 1.27.4, or 1.26.8, or a later supported release containing the fix. For bundled deployments, install the corresponding vendor update; identified fixes include Red Hat Migration Toolkit for Containers 1.7.16 and Red Hat OpenShift Service Mesh Containers 2.5.5.
No validated public exploits yet. Hidden: 1 not loaded here.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.