CVE-2024-30255
HighThe HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames.
Published Apr 4, 2024 · Updated Sep 8, 2026 · Also known as BIT-envoy-2024-30255, GHSA-j654-3ccm-vfmm
Key Facts
Patch immediately- CVE-2024-30255 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Envoy (Envoyproxy), ecs-service-connect-agent (amazon), openshift-service-mesh/grafana-rhel8:2.5.5 (redhat) and 15 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 88% probability of exploitation in the next 30 days.
- Fixed versions are available, including ecs-service-connect-agent v1.29.5.0-1.amzn2023, Envoy 1.26.8, Envoy 1.27.4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
88%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2024-30255 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Envoy is a cloud-native, open source edge and service proxy. The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. Envoy's HTTP/2 codec allows the client to send an unlimited number of CONTINUATION frames even after exceeding Envoy's header map limits. This allows an attacker to send a sequence of CONTINUATION frames without the END_HEADERS bit set causing CPU utilization, consuming approximately 1 core per 300Mbit/s of traffic and culminating in denial of service through CPU exhaustion. Users should upgrade to version 1.29.3, 1.28.2, 1.27.4, or 1.26.8 to mitigate the effects of the CONTINUATION flood. As a workaround, disable HTTP/2 protocol for downstream connections.
Affected Products
20 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| EnvoyEnvoyproxy | >= >= 1.29.0, < 1.29.3 | 1.26.8 |
| ecs-service-connect-agentamazon | See advisory | v1.29.5.0-1.amzn2023 |
| openshift-service-mesh/grafana-rhel8:2.5.5redhat | See advisory | 3 |
| openshift-service-mesh/istio-cni-rhel8:2.5.5redhat | See advisory | 4 |
| openshift-service-mesh/istio-must-gather-rhel8:2.5.5redhat | See advisory | 4 |
Patched Releases
ecs-service-connect-agent
v1.29.5.0-1.amzn2023
Envoy
1.26.8, 1.27.4, 1.28.2, 1.29.3
openshift-service-mesh/grafana-rhel8:2.5.5
3
openshift-service-mesh/istio-cni-rhel8:2.5.5
4
openshift-service-mesh/istio-must-gather-rhel8:2.5.5
4
openshift-service-mesh/kiali-ossmc-rhel8:1.73.14
3
openshift-service-mesh/kiali-rhel8:1.73.15
3
openshift-service-mesh/pilot-rhel8:2.5.5
4
openshift-service-mesh/proxyv2-rhel8:2.5.5
6
openshift-service-mesh/ratelimit-rhel8:2.5.5
3
rhceph/ceph-nvmeof-cli-rhel9:1.2.19
1
rhceph/grafana-rhel9:10.4.8
25
rhceph/keepalived-rhel9:2.2.8
41
rhceph/rhceph
7-rhel9:7-493
rhceph/rhceph-haproxy-rhel9:2.4.22
43
rhceph/rhceph-promtail-rhel9:v3.0.0
14
rhceph/snmp-notifier-rhel9:1.2.1
92
rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8:v1.7.16
6
Timeline
Publicly disclosed
Apr 4, 2024
Last updated
Sep 8, 2026
Weakness Type
- CWE-390 Detection of Error Condition Without Action
References
- advisoryRHBA-2025:1772
- advisoryRHSA-2024:4520
- advisoryRHSA-2024:7725
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30255.json
- advisoryhttp://www.openwall.com/lists/oss-security/2024/04/03/16
FAQ
Common Questions.
Envoy is a cloud-native, open source edge and service proxy.
Affected: Envoy (Envoyproxy) versions >= >= 1.29.0, < 1.29.3; ecs-service-connect-agent (amazon); openshift-service-mesh/grafana-rhel8:2.5.5 (redhat), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including ecs-service-connect-agent v1.29.5.0-1.amzn2023, Envoy 1.26.8, Envoy 1.27.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-30255 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo