CVE-2024-27919

HIGH

HTTP/2: memory exhaustion due to CONTINUATION frame flood

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-27919 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC.

Description

Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through memory exhaustion. Users should upgrade to versions 1.29.2 to mitigate the effects of the CONTINUATION flood. Note that this vulnerability is a regression in Envoy version 1.29.0 and 1.29.1 only. As a workaround, downgrade to version 1.28.1 or earlier or disable HTTP/2 protocol for downstream connections.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 16, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

envoy

Browse envoyproxy / envoy

Default status: unknown

CVE List1.29.0 to < 1.29.2affected
>= 1.29.0, < 1.29.2affected

Proofs of concept

1

Repository PoCs

GitHublockness-Ko/CVE-2024-27316Repository PoCby lockness-Ko18Not analyzed6 files

22.2 KiB · linked to 6 vulnerabilities

GitHub
PoC details

References

5