CVE-2024-53271CWE-670

HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy

High · published December 18, 2024

CVSS v3.1
7.1
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no known workarounds for this issue.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00618 · 49.0th percentile
Weakness
CWE-670 · Always-Incorrect Control Flow Implementation
Published
2024-12-18T19:12Z
EPSS history
Timeline
  • 18 DEC 19:12Z
    HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy
    cvelistv5