Read the docs
TI-2024-20001 Aliases CVE-2024-30255

HTTP/2: CPU exhaustion due to CONTINUATION frame flood

Priority HIGH 80CWE-390Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 12 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.85015 99th percentileScored 2026-11-07
Fix Partial envoy (envoyproxy): 1.29.3, 1.28.2, 1.27.4 +1Red Hat: 2 advisoriesRed Hat: 4 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
envoyproxyenvoy1.29.0 to before 1.29.3; 1.28.0 to before 1.28.2; 1.27.0 to before 1.27.4; before 1.26.81.29.3, 1.28.2, 1.27.4, 1.26.8Patch availableCNA
  • envoy Vendorenvoyproxy Affected 1.29.0 to before 1.29.3; 1.28.0 to before 1.28.2; 1.27.0 to before 1.27.4; before 1.26.8 Fixed in 1.29.3, 1.28.2, 1.27.4, 1.26.8 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:*before 1.26.8; 1.27.0 to before 1.27.4; 1.28.0 to before 1.28.2; 1.29.0 to before 1.29.3Vulnerableenvoyproxy
  • cpe:2.3:a:envoyproxy:envoy:*:*:*:*:*:*:*:* Versions before 1.26.8; 1.27.0 to before 1.27.4; 1.28.0 to before 1.28.2; 1.29.0 to before 1.29.3 Vulnerable ·envoyproxy

Remediation

  • Fix · CNA envoy (envoyproxy) Fixed in 1.29.3, 1.28.2, 1.27.4, 1.26.8

Red Hat 2 advisories

  • RHSA-2024:7725 Released 2024-10-07 · Red Hat rating Important
    Red Hat OpenShift Service Mesh Containers for 2.5.5
    • RHOSSM 2.5 for RHEL 8 openshift-service-mesh/grafana-rhel8, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel8 +5
  • RHSA-2024:4520 Released 2024-07-11 · Red Hat rating Important
    Migration Toolkit for Containers (MTC) 1.7.16 security and bug fix update
    • 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-rsync-transfer-rhel8 +2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Custom Metric Autoscaler operator for Red Hat OpenshiftAffectedNo fix planned: Will not fix
Logical Volume Manager StorageAffectedNo fix yet
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Ceph Storage 6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Data Science (RHODS)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 2AffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 3AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix planned: Will not fix
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
8Base-RHMTC-1.7Fixed RHSA-2024:4520
RHOSSM 2.5 for RHEL 8Fixed RHSA-2024:7725
Red Hat Ceph Storage 5.3 ToolsFixed—
Red Hat Ceph Storage 7.1 ToolsFixed—
Not affected: 7 products
  • 8Base-RHMTC-1.7
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift API for Data Protection
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-30255
  2. 2026-10-30 Fix available: Red Hat Ceph Storage 5.3 Tools · Red Hat

References

Patch 1

Advisory 1

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2024-18524 HTTP/2: memory exhaustion due to CONTINUATION frame flood CVSS 3.1HIGH 7.5
  • TI-2023-12215 Envoy client may fake the header `x-envoy-original-path` CVSS 3.1CRITICAL 9.1
  • TI-2023-18002 Envoy vulnerable to OAuth2 credentials exploit with permanent validity CVSS 3.1CRITICAL 9.8
  • TI-2023-12221 Envoy doesn't escape HTTP header values CVSS 3.1CRITICAL 9.1
See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences