{
  "cveId": "CVE-2024-53270",
  "url": "https://patchblox.com/security/cve/CVE-2024-53270",
  "summary": "CVE-2024-53270 is fixed in ecs-service-connect-agent on 1 platform by ALAS2023-2025-850 (version v1.29.12.0-1.amzn2023), released February 12, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ecs-service-connect-agent: Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2024-53270:\n\tEnvoy is...",
  "description": "Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities:\nCVE-2024-53270:\n\tEnvoy is a cloud-native high-performance edge/middle/service proxy. In affected versions \u0060sendOverloadError\u0060 is going to assume the active request exists when \u0060envoy.load_shed_points.http1_server_abort_dispatch\u0060 is configured. If \u0060active_request\u0060 is nullptr, only onMessageBeginImpl() is called. However, the \u0060onMessageBeginImpl\u0060 will directly return ok status if the stream is already reset leading to the nullptr reference. The downstream reset can actually happen during the H/2 upstream reset. As a result envoy may crash. This issue has been addressed in releases 1.32.3, 1.31.5, 1.30.9, and 1.29.12. Users are advised to upgrade. Users unable to upgrade may disable \u0060http1_server_abort_dispatch\u0060 load shed point and/or use a high threshold.",
  "published": "2025-02-12T22:57:00Z",
  "severity": "important",
  "epss": 0.00696,
  "epssPercentile": 0.53246,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ecs-service-connect-agent",
      "release": "amzn 2023",
      "fixedVersion": "v1.29.12.0-1.amzn2023",
      "fix": "ALAS2023-2025-850",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-850",
      "released": "2025-02-12T22:57:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}