CVE-2024-30255
Envoyproxy Envoy ≤ 1.26.8
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSummary
CVE-2024-30255 is a medium-severity Detection of Error Condition Without Action (CWE-390) vulnerability in Envoyproxy Envoy. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Envoy is a cloud-native open source edge and service proxy whose HTTP/2 protocol stack is affected by CVE-2024-30255. Versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 contain a flaw in the HTTP/2 codec that permits a client to transmit an unlimited number of CONTINUATION frames after Envoy's header map limits have already been exceeded. This behavior stems from incomplete enforcement of frame sequencing rules defined in CWE-390 and enables sustained CPU consumption at roughly one core per 300 Mbit/s of malicious traffic.
An unauthenticated network attacker can exploit the issue by sending a stream of CONTINUATION frames that lack the END_HEADERS flag. The resulting flood drives CPU utilization to exhaustion, producing a denial-of-service condition against the proxy without requiring any special privileges or user interaction. The CVSS 5.3 rating reflects the network attack vector, low complexity, and availability impact.
Official advisories recommend immediate upgrade to one of the patched releases. As a temporary workaround, operators can disable HTTP/2 support on downstream listener configurations. The associated EPSS score stands at 0.8881 with no indicated rise from a lower baseline.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-28182
Vulnerability Data
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the…
more
client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation will surface code paths that detect errors yet perform no subsequent action.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Declaring incidents when criteria are met forces action on detected errors; eliminating the weakness helps but does not define the criteria themselves.
Triaging and validating reports compels follow-up on detections; removing the weakness supports but does not replace triage processes.
Analysis of detected events directly counters ignoring them, but does not guarantee every error condition is covered.
Monitoring produces detections, yet supplies no requirement to act on them.
Generating logs enables later action but does not enforce handling of each error condition.
Root-cause analysis of incidents requires acting on detected anomalies, though it applies after an incident is already declared.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover missing error handling, but does not ensure the weakness is eliminated in production code.
Logging captures error conditions but does not guarantee subsequent handling or remediation.
Monitoring activities can detect errors, yet without defined response procedures the weakness persists.
Secure development lifecycle practices encourage proper error handling, but do not mandate it for every detected condition.
Secure coding standards typically require explicit error handling, reducing the likelihood of silent failures.