UpHeron
All vulnerabilities

Servers and applications

CVE-2024-53271

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset

Severity
High 7.1
Published
18 Dec 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.31.5
Also known as
GHSA-rmm5-h2wv-mg4f
Sources
NVD, Project advisories (GitHub)

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no known workarounds for this issue.

Affected software

SoftwareAffected versions
EnvoyServers and applications · cpe:a:envoyproxy:envoy
  • From 1.31.0 before 1.31.5
  • From 1.32.0 up to 1.32.3
EnvoyServers and applications · github:envoyproxy/envoy
  • From 1.31.0 before 1.31.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-53271
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-53271
  • GitHub Advisory Database https://github.com/advisories/GHSA-rmm5-h2wv-mg4f
  • github.com https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4f