How severe is CVE-2024-22279?

CVE-2024-22279 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2024-22279 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-22279?

CVE-2024-22279 primarily affects Cloudfoundry Cf-deployment. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-22279?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-22279 have an EU (EUVD) identifier?

Yes. CVE-2024-22279 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19841.

When was CVE-2024-22279 published?

CVE-2024-22279 was published on 2024-06-10 and last updated on 2026-06-17.

CVE-2024-22279

CVE-2024-22279 is a medium-severity vulnerability in Cloudfoundry Cf-deployment with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-444.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
EPSS exploit prediction: 0% (32nd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-19841
Weakness: CWE-444
Affected product: Cloudfoundry Cf-deployment
Published: 2024-06-10
Last modified: 2026-06-17

Description

Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.

Frequently asked questions

What is CVE-2024-22279?: Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.
How severe is CVE-2024-22279?: CVE-2024-22279 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2024-22279 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (32nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-22279?: CVE-2024-22279 primarily affects Cloudfoundry Cf-deployment. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-22279?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-22279 have an EU (EUVD) identifier?: Yes. CVE-2024-22279 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-19841.
When was CVE-2024-22279 published?: CVE-2024-22279 was published on 2024-06-10 and last updated on 2026-06-17.

References

https://www.cloudfoundry.org/blog/cve-2024-22279-gorouter-denial-of-service-attack/

Affected products (2)

cpe:2.3:a:cloudfoundry:cf-deployment:*:*:*:*:*:*:*:*
cpe:2.3:a:cloudfoundry:routing_release:*:*:*:*:*:*:*:*

More vulnerabilities in Cloudfoundry Cf-deployment

CVE-2019-3801 — Critical (CVSS 9.8): Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to…
CVE-2022-31733 — Critical (CVSS 9.1): Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are…
CVE-2020-5417 — High (CVSS 8.8): Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also…
CVE-2020-5402 — High (CVSS 8.8): In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not…
CVE-2019-11283 — High (CVSS 8.8): Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote…
CVE-2018-1191 — High (CVSS 8.8): Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access…

All CVEs affecting Cloudfoundry Cf-deployment →

Other CWE-444 (HTTP Request/Response Smuggling) vulnerabilities

CVE-2025-1867 — Critical (CVSS 10.0): Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows…
CVE-2022-22536 — Critical (CVSS 10.0): SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53…
CVE-2018-3907 — Critical (CVSS 10.0): An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub…
CVE-2025-55315 — Critical (CVSS 9.9): Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized…
CVE-2020-15049 — Critical (CVSS 9.9): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request…
CVE-2026-13763 — Critical (CVSS 9.8): Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote…

Browse all CWE-444 (HTTP Request/Response Smuggling) vulnerabilities →