CVE-2024-53270

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable `http1_server_abort_dispatch` load shed point and/or use a high threshold.

• CWE-670
• CWE-476

• https://github.com/envoyproxy/envoy/pull/37743/commits/6cf8afda956ba67c9afad185b962325a5242ef02Patch
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3Exploit, Mitigation, Third Party Advisory
• https://github.com/envoyproxy/envoy/security/advisories/GHSA-q9qv-8j52-77p3Exploit, Mitigation, Third Party Advisory

Published

Dec 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-53264bunkerweb is an Open-source and next-generation Web Applicat…5.1
• CVE-2024-53266Discourse is an open source platform for community discussio…5.4
• CVE-2024-53267sigstore-java is a sigstore java client for interacting with…5.5
• CVE-2024-53268Joplin is an open source, privacy-focused note taking app wi…8.8
• CVE-2024-53269Envoy is a cloud-native high-performance edge/middle/service…7.5
• CVE-2024-5327The PowerPack Addons for Elementor (Free Widgets, Extensions…5.4
• CVE-2024-53271Envoy is a cloud-native high-performance edge/middle/service…7.1
• CVE-2024-53272Habitica is an open-source habit-building program. Versions …6.1
• CVE-2024-53273Habitica is an open-source habit-building program. Versions …6.1
• CVE-2024-53274Habitica is an open-source habit-building program. Versions …6.1
• CVE-2024-53275Home-Gallery.org is a self-hosted open-source web gallery to…5.3
• CVE-2024-53276Home-Gallery.org is a self-hosted open-source web gallery to…6.3