Riskcovery

CVE-2024-30255

HTTP/2: CPU exhaustion due to CONTINUATION frame flood

State
Published
Severity
5.3 Medium
Published
Apr 4, 2024
Updated
Nov 4, 2025
Reserved
Mar 26, 2024

Read the record on cve.org

Description

Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.

Scores

CVSSScoreVectorSource
3.15.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LGitHub_M

Weaknesses

  • CWE-390 Detection of Error Condition Without Action

Affected Products

ProductVersions
envoyenvoyproxy
  • >= 1.29.0, < 1.29.3Affected
  • >= 1.28.0, < 1.28.2Affected
  • >= 1.27.0, < 1.27.4Affected
  • < 1.26.8Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.