CVE-2024-53271: envoyproxy envoy
Vulnerability summary
CVE-2024-53271 is a high (CVSS 7.1) vulnerability in envoyproxy envoy. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 18-12-2024PublishedVulnerability first disclosed.
- 18-12-2024Last modifiedVulnerability information updated.
Description
Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions envoy does not properly handle http 1.1 non-101 1xx responses. This can lead to downstream failures in networked devices. This issue has been addressed in versions 1.31.5 and 1.32.3. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST7.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundEnvoy
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Envoyproxy1 product
- envoy≥ 1.32.0, < 1.32.3 | ≥ 1.31.0, < 1.31.5 | ≥ 1.32.0, ≤ 1.32.3
1 vendor · 1 product
References
2 links- github.com/envoyproxy/envoy/security/advisories/GHSA-rmm5-h2wv-mg4fX Refsource CONFIRMExploitThird Party Advisory