UpHeron
All vulnerabilities

Servers and applications

CVE-2024-53270

HTTP/1: sending overload crashes when the request is reset beforehand

Severity
High 7.5
Published
18 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.29.12, 1.30.9, 1.31.5, 1.32.3
Also known as
GHSA-q9qv-8j52-77p3
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset…

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • Every version before 1.29.12
  • From 1.30.0 before 1.30.9
  • From 1.31.0 before 1.31.5
  • From 1.32.0 before 1.32.3
EnvoyServers and applications · github:envoyproxy/envoy
  • Every version before 1.29.12

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-53270
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-53270
  • GitHub Advisory Database https://github.com/advisories/GHSA-q9qv-8j52-77p3
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3