Read the docs
TI-2024-18524 Aliases CVE-2024-27919

HTTP/2: memory exhaustion due to CONTINUATION frame flood

Priority HIGH 80CWE-390Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Envoy is a cloud-native, open-source edge and service proxy. In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. Envoy's HTTP/2 codec does not reset a request when header map limits have been exceeded. This allows an attacker to send an sequence of CONTINUATION frames without the END_HEADERS bit set causing unlimited memory consumption. This can lead to denial of service through memory exhaustion. Users should upgrade to versions 1.29.2 to mitigate the effects of the CONTINUATION flood. Note that this vulnerability is a regression in Envoy version 1.29.0 and 1.29.1 only. As a workaround, downgrade to version 1.28.1 or earlier or disable HTTP/2 protocol for downstream connections.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.83893 99th percentileScored 2026-11-07
Fix Fixed envoy (envoyproxy): 1.29.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
envoyproxyenvoy1.29.0 to before 1.29.21.29.2Patch availableCNA
  • envoy Vendorenvoyproxy Affected 1.29.0 to before 1.29.2 Fixed in 1.29.2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:envoyproxy:envoy:1.29.0:*:*:*:*:*:*:*1.29.0Vulnerableenvoyproxy
cpe:2.3:a:envoyproxy:envoy:1.29.1:*:*:*:*:*:*:*1.29.1Vulnerableenvoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.29.0:*:*:*:*:*:*:* Versions 1.29.0 Vulnerable ·envoyproxy
  • cpe:2.3:a:envoyproxy:envoy:1.29.1:*:*:*:*:*:*:* Versions 1.29.1 Vulnerable ·envoyproxy

Remediation

  • Fix · CNA envoy (envoyproxy) Fixed in 1.29.2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 21 products
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Migration Toolkit for Applications 6
  • Migration Toolkit for Containers
  • OpenShift API for Data Protection
  • OpenShift Serverless
  • OpenShift Service Mesh 2
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Ceph Storage 5
  • Red Hat Ceph Storage 6
  • Red Hat Ceph Storage 7
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenShift distributed tracing 3
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Container Storage 4
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27919

References

Patch 2

Advisory 1

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-20001 HTTP/2: CPU exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
  • TI-2023-12215 Envoy client may fake the header `x-envoy-original-path` CVSS 3.1CRITICAL 9.1
  • TI-2023-18002 Envoy vulnerable to OAuth2 credentials exploit with permanent validity CVSS 3.1CRITICAL 9.8
  • TI-2023-12221 Envoy doesn't escape HTTP header values CVSS 3.1CRITICAL 9.1
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences