CVE-2024-27919
published 2024-04-04CVE-2024-27919: Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of…
PriorityP261high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
86.75%
99.7th percentile
Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through memory exhaustion. Users should upgrade to versions 1.29.2 to mitigate the effects of the CONTINUATION flood. Note that this vulnerability is a regression in Envoy version 1.29.0 and 1.29.1 only. As a workaround, downgrade to version 1.28.1 or earlier or disable HTTP/2 protocol for downstream connections.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
| envoyproxy | envoy | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP/2 CONTINUATION frame floods: look for streams with a high volume of CONTINUATION frames sent without the END_HEADERS bit set, which indicates potential exploitation of this vulnerability. ↗
- →Monitor Envoy proxy processes for abnormal memory growth or exhaustion, which may indicate an active CONTINUATION flood attack against HTTP/2 downstream connections. ↗
- →The vulnerability is specific to Envoy's oghttp codec implementation — focus detection efforts on Envoy instances using the oghttp codec with HTTP/2 enabled on downstream connections. ↗
- →Unauthenticated remote attackers can trigger this — ensure network-level monitoring covers unauthenticated HTTP/2 traffic to Envoy endpoints, not just authenticated sessions. ↗
- ·Vulnerability is a regression present ONLY in Envoy versions 1.29.0 and 1.29.1. Versions 1.28.x and earlier are NOT affected. Scope detection and patching efforts accordingly. ↗
- ·As a workaround, HTTP/2 protocol can be disabled for downstream connections to eliminate the attack surface without upgrading. ↗
- ·No Red Hat products ship a vulnerable version of Envoy; all listed Red Hat packages are confirmed not affected. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
New HTTP/2 DoS attack can crash web servers with a single connection
blogs_bleepingcomputer·2024-04-04
New HTTP/2 DoS attack can crash web servers with a single connection
## New HTTP/2 DoS attack can crash web servers with a single connection
## Bill Toulas
Newly discovered HTTP/2 protocol vulnerabilities called "CONTINUATION Flood" can lead to denial of service (DoS) attacks, crashing web servers with a single TCP connection in some implementations.
HTTP/2 is an update to the HTTP protocol standardized in 2015, designed to improve web performance by introducing binary framing for efficient data transmission, multiplexing to allow multiple requests and responses over a single connection, and header compression to reduce overhead
The new CONTINUATION Flood vulnerabilities were discovered by researcher Barket Nowotarski , who says that it relates to the use of HTTP/2 CONTINUATION frames, which are not properly limited or checked in many implementations of
Bugzilla
CVE-2024-27919 envoy: CONTINUATION frames which enable DoS
bugzilla·2024-03-13·CVSS 7.5
CVE-2024-27919 [HIGH] CVE-2024-27919 envoy: CONTINUATION frames which enable DoS
CVE-2024-27919 envoy: CONTINUATION frames which enable DoS
Envoy is vulnerable to a DoS caused by how it continues to receive CONTINUATION frames, and will not callback to the application to allow visibility into this information before it resets the stream.
http://www.openwall.com/lists/oss-security/2024/04/03/16http://www.openwall.com/lists/oss-security/2024/04/05/3https://github.com/envoyproxy/envoy/commit/57a02565532c18eb9df972a3e8974be3ae59f2d5https://github.com/envoyproxy/envoy/security/advisories/GHSA-gghf-vfxp-799rhttp://www.openwall.com/lists/oss-security/2024/04/03/16http://www.openwall.com/lists/oss-security/2024/04/05/3https://github.com/envoyproxy/envoy/commit/57a02565532c18eb9df972a3e8974be3ae59f2d5https://github.com/envoyproxy/envoy/security/advisories/GHSA-gghf-vfxp-799rhttps://www.kb.cert.org/vuls/id/421644
2024-04-04
Published