CVE-2024-30255: HTTP/2: CPU exhaustion due to CONTINUATION frame flood
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the ENDHEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.
Other sources
HTTP/2 protocol stack in Envoy versions 1.29.2 or earlier are vulnerable to CPU exhaustion due to flood of CONTINUATION frames.
Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the ENDHEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.29.3 - Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.28.2 - Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.27.4 - Upgrade
Upgrade
redhat/envoyto a version that resolves this vulnerability.Fixed in 1.26.8 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.29.3 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.28.2 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.27.4 - Upgrade
Upgrade
Envoyto a version that resolves this vulnerability.Fixed in 1.26.8 - Configuration
Disable the HTTP/2 protocol for downstream connections as a workaround.
Envoy downstream connections HTTP/2 protocol = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30255?
CVE-2024-30255 is classified as a high-severity vulnerability due to its potential to cause CPU exhaustion in the affected Envoy versions.
How do I fix CVE-2024-30255?
To fix CVE-2024-30255, you should upgrade Envoy to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 or later.
Which Envoy versions are affected by CVE-2024-30255?
CVE-2024-30255 affects Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8.
What type of attack does CVE-2024-30255 facilitate?
CVE-2024-30255 facilitates a denial-of-service attack through CPU exhaustion via excessive CONTINUATION frames.
Is there a mitigation for CVE-2024-30255 if I cannot upgrade?
If upgrading is not possible, implementing rate limiting on HTTP/2 traffic may help mitigate the effects of CVE-2024-30255.