onyx --cves cve-2024-27919
CVE-2024-27919
- score
- <0.1
- cvss
- 7.5
- epss
- 86.7%
- published
- 2024-04-04
- kev added
- —
- first seen
Envoy versions 1.29.0 and 1.29.1 contain a denial of service caused by the HTTP/2 protocol stack not resetting requests when header limits are exceeded, letting attackers flood with CONTINUATION frames, exploit requires sending a sequence of CONTINUATION frames without END_HEADERS.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
Weaknesses
References 5
- https://github.com/envoyproxy/envoy/commit/57a02565532c18eb9df972a3e8974be3ae59f2d5
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-gghf-vfxp-799r
- https://www.kb.cert.org/vuls/id/421644
- http://www.openwall.com/lists/oss-security/2024/04/03/16
- http://www.openwall.com/lists/oss-security/2024/04/05/3