Is CVE-2024-53270 actively exploited?

CVE-2024-53270 has no public evidence of in-the-wild exploitation as of 2025-09-04.

What is the CVSS score for CVE-2024-53270?

CVE-2024-53270 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

How do I patch CVE-2024-53270?

Patch guidance is available from envoyproxy security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2024-53270.

Fix CVE-2024-53270 - HIGH envoyproxy envoy

Q: Which products are affected by CVE-2024-53270?

4 products: envoyproxy envoy, envoyproxy envoy, envoyproxy envoy, envoyproxy envoy.

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. In affected versions `sendOverloadError` is going to assume the active request exists when `envoy.load_shed_points.http1_server_abort_dispatch` is configured. If `active_request` is nullptr, only onMessageBeginImpl() is called. However, the `onMessageBeginImpl` will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable `http1_server_abort_dispatch` load shed point and/or use a high threshold.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-670 CWE-476 · NULL Pointer Dereference

Metadata

Primary Vendor: ENVOYPROXY
Published: 12/18/2024
Last Modified: 9/4/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

envoyproxy : envoyenvoyproxy : envoyenvoyproxy : envoyenvoyproxy : envoy

Remediation Guidance

Executive Summary

Cite this page

CVE-2024-53270. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2024-53270

View on NIST NVD

CVE-2024-53270 vulnerability