Bug 2269444 (CVE-2024-27919) - CVE-2024-27919 envoy: CONTINUATION frames which enable DoS
Summary: CVE-2024-27919 envoy: CONTINUATION frames which enable DoS
Keywords:
Status: NEW
Alias: CVE-2024-27919
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2268258
TreeView+ depends on / blocked
 
Reported: 2024-03-13 22:38 UTC by Nick Tait
Modified: 2025-05-06 08:29 UTC (History)
51 users (show)

Fixed In Version: envoy 1.29.2
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Nick Tait 2024-03-13 22:38:27 UTC 
Envoy is vulnerable to a DoS caused by how it continues to receive CONTINUATION frames, and will not callback to the application to allow visibility into this information before it resets the stream.
Note You need to log in before you can comment on or make changes to this bug.