HTTP/2: CPU exhaustion due to CONTINUATION frame flood
No sign of exploitation. No public exploitation artifact known so far.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Envoy proxy is vulnerable to a denial-of-service attack where an attacker floods the server with HTTP/2 CONTINUATION frames, causing excessive CPU usage and making the service unavailable. This happens because Envoy doesn't properly limit these frames even after reaching its header size limits.
The HTTP/2 codec in Envoy prior to versions 1.29.3, 1.28.2, 1.27.4, and 1.26.8 fails to enforce limits on CONTINUATION frames without END_HEADERS bit, allowing unauthenticated remote attackers to send unlimited frames that consume approximately 1 CPU core per 300Mbit/s of malicious traffic. The attack vector is network-based and requires no authentication, resulting in CPU exhaustion and denial of service.