CVE-2024-30255— HTTP/2: CPU exhaustion due to CONTINUATION frame flood
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-30255
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
HTTP/2: CPU exhaustion due to CONTINUATION frame flood
Source: NVD (National Vulnerability Database)
Vulnerability Description
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
未有动作错误条件的检测
Source: NVD (National Vulnerability Database)
Vulnerability Title
Envoy 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Envoy是一款开源的分布式代理服务器。 Envoy存在安全漏洞，该漏洞源于HTTP/2协议栈容易因为连续帧泛滥而导致CPU耗尽。受影响的产品和版本：Envoy 1.29.3之前版本，1.28.2之前版本，1.27.4之前版本，1.26.8 之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| envoyproxy | envoy | >= 1.29.0, < 1.29.3 | - |
II. Public POCs for CVE-2024-30255
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | CVE-2024-30255 This repository contains a proof-of-concept (PoC) Python script to demonstrate the CPU exhaustion vulnerability in Envoy caused by a flood of CONTINUATION frames. | https://github.com/blackmagic2023/Envoy-CPU-Exhaustion-Vulnerability-PoC | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-30255
请登录查看更多情报信息。
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-j654-3ccm-vfmmx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2024-30255
IV. Related Vulnerabilities
Same product: envoy
- CVE-2026-6994
Envoy Query Parameter header_mutation.cc params.add injectio - CVE-2026-26330
Envoy global rate limit may crash when the response phase li - CVE-2026-26311
Envoy HTTP: filter chain execution on reset streams causing - CVE-2026-26310
Crash for scoped ip address in Envoy during DNS - CVE-2026-26309
Envoy has an off-by-one write in JsonEscaper::escapeString()
Same vendor: envoyproxy
- CVE-2026-26330
Envoy global rate limit may crash when the response phase li - CVE-2026-26311
Envoy HTTP: filter chain execution on reset streams causing - CVE-2026-26310
Crash for scoped ip address in Envoy during DNS - CVE-2026-26309
Envoy has an off-by-one write in JsonEscaper::escapeString() - CVE-2026-26308
Envoy has an RBAC Header Validation Bypass via Multi-Value H
Same weakness: CWE-390
- CVE-2025-0029
AMD EPYC 9005 Series 安全漏洞 - CVE-2025-46367
Dell Alienware Command Center 安全漏洞 - CVE-2025-27039
Detection of Error Condition Without Action in Computer Visi - CVE-2024-49841
Detection of Error Condition Without Action in Hypervisor - CVE-2025-26465
Openssh: machine-in-the-middle attack if verifyhostkeydns is
V. Comments for CVE-2024-30255
No comments yet