← back
CVE-2024-30255mediumCWE-390

HTTP/2: CPU exhaustion due to CONTINUATION frame flood

35Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 88%
exploitation probability
88%top 1% of all CVEs
observed exploitation
nono source reports it
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Affected
13 products (15 components)
Red Hat OpenShift Container Platform 4 · Red Hat OpenShift Data Science (RHODS) · Custom Metric Autoscaler operator for Red Hat Openshift · Logical Volume Manager Storage · Migration Toolkit for Applications 6 · and others 8
workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Fixed
3 products (53 components)
RHOSSM 2.5 for RHEL 8 · Red Hat Ceph Storage 7.1 Tools · 8Base-RHMTC-1.7
Not affected
7 products (24 components) — because the vulnerable code is not present in the product
8Base-RHMTC-1.7 · OpenShift API for Data Protection · Red Hat Advanced Cluster Management for Kubernetes 2 · Logging Subsystem for Red Hat OpenShift · Red Hat OpenShift Container Platform 4 · and others 2
In short

Envoy proxy is vulnerable to a denial-of-service attack where an attacker floods the server with HTTP/2 CONTINUATION frames, causing excessive CPU usage and making the service unavailable. This happens because Envoy doesn't properly limit these frames even after reaching its header size limits.

Technical detail

The HTTP/2 codec in Envoy prior to versions 1.29.3, 1.28.2, 1.27.4, and 1.26.8 fails to enforce limits on CONTINUATION frames without END_HEADERS bit, allowing unauthenticated remote attackers to send unlimited frames that consume approximately 1 CPU core per 300Mbit/s of malicious traffic. The attack vector is network-based and requires no authentication, resulting in CPU exhaustion and denial of service.

Summary generated and translated by AI from the official description.
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
envoyproxy · envoy