CVE-2024-53270: Envoyproxy Envoy DoS Vulnerability

CVE-2024-53270 Overview

CVE-2024-53270 is a null pointer dereference vulnerability in Envoy, a cloud-native high-performance edge, middle, and service proxy. The flaw exists in the sendOverloadError function, which assumes an active request exists when envoy.load_shed_points.http1_server_abort_dispatch is configured. When active_request is nullptr, only onMessageBeginImpl() runs, but it returns an OK status if the stream is already reset. This produces a null pointer reference that crashes the Envoy process. A downstream reset triggered during an HTTP/2 upstream reset can reach the vulnerable code path remotely.

Critical Impact
Unauthenticated remote attackers can crash Envoy proxy instances, causing denial of service for all services routed through the affected proxy.

Affected Products

Envoy versions prior to 1.29.12
Envoy versions prior to 1.30.9, 1.31.5
Envoy versions prior to 1.32.3

Discovery Timeline

2024-12-18 - CVE-2024-53270 published to NVD
2025-09-04 - Last updated in NVD database

Technical Details for CVE-2024-53270

Vulnerability Analysis

The vulnerability resides in Envoy's HTTP/1 codec overload handling logic. When operators enable the envoy.load_shed_points.http1_server_abort_dispatch load shed point, the sendOverloadError function expects an active request object to be present. The function fails to validate that active_request is non-null before proceeding with its dispatch logic.

When active_request is nullptr, the code path invokes only onMessageBeginImpl(). This function short-circuits and returns an OK status when the stream has already been reset, bypassing the logic that would normally allocate or validate the request state. Subsequent code dereferences the still-null active_request pointer, crashing the proxy.

The vulnerability is classified under [CWE-476] (NULL Pointer Dereference) and [CWE-670] (Always-Incorrect Control Flow Implementation).

Root Cause

The root cause is missing null-pointer validation in sendOverloadError combined with a control flow assumption that does not hold when an HTTP/2 upstream reset triggers a downstream reset before request state is established. The onMessageBeginImpl early-return on already-reset streams leaves active_request uninitialized while the caller proceeds as if it were valid.

Attack Vector

An unauthenticated remote attacker can trigger the crash by sending crafted HTTP traffic that causes an HTTP/2 upstream reset while the http1_server_abort_dispatch load shed point is active. Because the issue is reachable over the network without authentication or user interaction, any internet-exposed Envoy instance with the affected configuration is at risk of denial of service. Refer to the GitHub Security Advisory GHSA-q9qv-8j52-77p3 for the upstream technical description.

Detection Methods for CVE-2024-53270

Indicators of Compromise

Unexpected Envoy process crashes or restarts with SIGSEGV signals in container or systemd logs
Crash stack traces referencing sendOverloadError, onMessageBeginImpl, or HTTP/1 codec dispatch frames
Spikes in upstream HTTP/2 stream resets correlated with downstream connection terminations
Repeated short-lived connections from the same source preceding proxy restarts

Detection Strategies

Monitor Envoy admin endpoint statistics for server.crash and abnormal increases in http1.dispatch_error counters
Correlate load shed point activation events with HTTP/2 upstream reset metrics in observability platforms
Inspect container orchestrator events for repeated Envoy pod restarts with non-zero exit codes

Monitoring Recommendations

Enable structured crash logging and forward stack traces to a centralized logging system for analysis
Alert on Envoy version strings reported via the admin interface that match vulnerable releases
Track HTTP/2 upstream reset rates and correlate with downstream client behavior to identify abuse patterns

How to Mitigate CVE-2024-53270

Immediate Actions Required

Upgrade Envoy to version 1.32.3, 1.31.5, 1.30.9, or 1.29.12 depending on your release branch
Inventory all Envoy deployments, including service mesh sidecars and ingress gateways, to confirm patched versions
Review configurations for the envoy.load_shed_points.http1_server_abort_dispatch setting and assess exposure

Patch Information

The fix is available in Envoy releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. The upstream patch is documented in the Envoy GitHub Pull Request commit 6cf8afda, which adds the necessary null-pointer validation in the HTTP/1 codec dispatch path.

Workarounds

Disable the envoy.load_shed_points.http1_server_abort_dispatch load shed point if it is not required for operational load shedding
Configure a high threshold for the load shed point so it activates only under extreme conditions, reducing the practical attack surface
Restrict network exposure of Envoy admin and proxy interfaces to trusted clients where feasible

bash

# Example: remove or raise threshold for the affected load shed point in Envoy bootstrap config
# Disable by omitting envoy.load_shed_points.http1_server_abort_dispatch from overload_manager.resource_monitors
# Or set a high threshold so it is unlikely to trigger
overload_manager:
  actions:
  - name: "envoy.load_shed_points.http1_server_abort_dispatch"
    triggers:
    - name: "envoy.resource_monitors.global_downstream_max_connections"
      threshold:
        value: 0.95