CVE-2024-53271

Name: CVE-2024-53271
Creator: NVD / NIST
Published: 2024-12-18T20:15:24.433+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.1/10EPSS 0.61%

Last modified Jun 17, 2026

CVE-2024-53271 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. EPSS estimates a 0.61% chance of exploitation in the next 30 days.

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no known workarounds for this issue.

Metrics

CVSS 3.1

7.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

EPSS Probability

0.61%

44.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-670

Affected Software

Vendor	Product	Versions
Envoyproxy	Envoy	>= 1.31.0, < 1.31.5
Envoyproxy	Envoy	>= 1.32.0, <= 1.32.3

References

https://github.com/envoyproxy/envoy/commit/da56f6da63079baecef9183436ee5f4141a59af8Patch
https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4fExploit, Third Party Advisory
https://github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4fExploit, Third Party Advisory

Timeline

Published: Dec 18, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-53271?

How severe is CVE-2024-53271?

CVE-2024-53271 has a CVSS score of 7.1/10 (HIGH severity). The EPSS model estimates a 0.61% probability of exploitation in the next 30 days.

How do I fix CVE-2024-53271?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-53271?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST