CVE-2024-45807: Envoyproxy Envoy DoS Vulnerability

CVE-2024-45807 Overview

CVE-2024-45807 affects Envoy, a cloud-native high-performance edge, middle, and service proxy widely deployed in service mesh and API gateway architectures. Envoy 1.31 introduced oghttp2 as the default HTTP/2 codec. Stream management defects in this codec can cause the proxy to crash, producing a denial-of-service condition. The maintainers addressed the issue in version 1.31.2 by disabling oghttp2 as the default codec. The vulnerability is tracked under [CWE-670] (Always-Incorrect Control Flow Implementation) and is reachable over the network without authentication.

Critical Impact
A remote, unauthenticated attacker can crash Envoy proxies running 1.31 with the default codec configuration, disrupting traffic for all services routed through the affected instances.

Affected Products

Envoyproxy Envoy 1.31 (using oghttp2 as default HTTP/2 codec)
Service mesh deployments built on Envoy 1.31 (e.g., Istio data planes)
API gateway and edge proxy deployments using Envoy 1.31

Discovery Timeline

2024-09-20 - CVE-2024-45807 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45807

Vulnerability Analysis

Envoy 1.31 shipped with oghttp2 set as the default HTTP/2 codec implementation. The oghttp2 codec contains stream management defects that can be triggered by remote peers sending HTTP/2 traffic. When the defective code path executes, Envoy terminates abnormally, dropping all in-flight connections and any traffic routed through the proxy.

Because Envoy frequently operates as an edge proxy, ingress controller, or service mesh sidecar, a single crash can interrupt application traffic across many downstream services. Repeated triggering produces a sustained denial-of-service condition against any workload fronted by the affected proxy.

The maintainers resolved the issue in Envoy 1.31.2 by switching the default HTTP/2 codec away from oghttp2, reverting to the prior codec implementation until the stream management defects are fully resolved.

Root Cause

The root cause is incorrect control flow handling within the oghttp2 codec's stream management logic. The advisory describes "potential bugs around stream management," consistent with the [CWE-670] classification. Specific defective stream state transitions cause Envoy to reach an unrecoverable state and crash rather than gracefully rejecting malformed or unexpected stream behavior.

Attack Vector

The vulnerability is exploitable remotely over the network with no authentication and no user interaction. An attacker sends crafted HTTP/2 traffic to an Envoy 1.31 proxy using the default oghttp2 codec. The malformed stream sequence triggers the codec defect and crashes the process. No code execution or data disclosure results; impact is limited to availability.

No verified public proof-of-concept code examples are available. Refer to the Envoy GitHub Security Advisory GHSA-qc52-r4x5-9w37 for vendor technical details.

Detection Methods for CVE-2024-45807

Indicators of Compromise

Unexpected Envoy process termination or restart events in container or systemd logs
Abrupt connection resets reported by upstream and downstream services routed through Envoy
Crash signatures referencing oghttp2 or HTTP/2 codec frames in Envoy stderr or core dumps
Spikes in HTTP/2 stream resets (RST_STREAM) preceding proxy restarts

Detection Strategies

Inventory Envoy deployments and identify instances running version 1.31.0 or 1.31.1 with the default codec configuration
Correlate proxy restart events with inbound HTTP/2 traffic patterns from untrusted clients
Inspect Envoy admin endpoint statistics for elevated http2.rx_reset and codec error counters

Monitoring Recommendations

Alert on repeated Envoy pod restarts or sidecar crash loops in Kubernetes environments
Forward Envoy access and crash logs to a central logging platform and alert on codec-related panics
Track HTTP/2 codec configuration values across all Envoy fleets to confirm oghttp2 is disabled

How to Mitigate CVE-2024-45807

Immediate Actions Required

Upgrade all Envoy instances to version 1.31.2 or later, where oghttp2 is no longer the default codec
For service mesh users, update Istio or other Envoy-based control planes to releases shipping the patched Envoy build
Restrict exposure of Envoy 1.31 instances to untrusted networks until patching is complete

Patch Information

The fix is available in Envoy release 1.31.2. The patch disables oghttp2 as the default HTTP/2 codec. All users of Envoy 1.31 are advised to upgrade. See the Envoy GitHub Security Advisory GHSA-qc52-r4x5-9w37 for release details.

Workarounds

The vendor advisory states there are no known workarounds; upgrading to 1.31.2 is required
Operators unable to upgrade immediately should consider rolling back to a prior Envoy minor release that does not default to oghttp2

bash

# Verify Envoy version and upgrade to a patched release
envoy --version

# Example: pin Envoy image to a patched version in Kubernetes
# kubectl set image deployment/envoy envoy=envoyproxy/envoy:v1.31.2