CVE-2024-27983
published 2024-04-09CVE-2024-27983: An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is…
PriorityP265high8.2CVSS 3.0
AVNACLPRNUINSUCNILAH
EPSS
87.21%
99.7th percentile
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Affected
30 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nodejs | < nodejs 18.20.4+dfsg-1~deb12u1 (bookworm) | nodejs 18.20.4+dfsg-1~deb12u1 (bookworm) |
| msrc | azl3_nodejs_20.10.0-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-1_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_nodejs18_18.18.2-7_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| nodejs | node | >= 10.0 < 10.* | 10.* |
| nodejs | node | >= 11.0 < 11.* | 11.* |
| nodejs | node | >= 12.0 < 12.* | 12.* |
| nodejs | node | >= 13.0 < 13.* | 13.* |
| nodejs | node | >= 14.0 < 14.* | 14.* |
| nodejs | node | >= 15.0 < 15.* | 15.* |
| nodejs | node | >= 16.0 < 16.* | 16.* |
| nodejs | node | >= 17.0 < 17.* | 17.* |
| nodejs | node | >= 18.0 < 18.20.1 | 18.20.1 |
| nodejs | node | >= 19.0 < 19.* | 19.* |
| nodejs | node | >= 20.0 < 20.12.1 | 20.12.1 |
| nodejs | node | >= 21.0 < 21.7.2 | 21.7.2 |
| nodejs | node | >= 4.0 < 4.* | 4.* |
| nodejs | node | >= 5.0 < 5.* | 5.* |
| nodejs | node | >= 6.0 < 6.* | 6.* |
| nodejs | node | >= 7.0 < 7.* | 7.* |
| nodejs | node | >= 8.0 < 8.* | 8.* |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP/2 CONTINUATION frame flood followed by abrupt TCP connection reset targeting Node.js HTTP/2 servers — the attack sends a small number of HTTP/2 frames packets containing HTTP/2 CONTINUATION frames and then abruptly closes the TCP connection ↗
- →Monitor for Node.js process crashes with assertion failure in node::http2::Http2Session::~Http2Session() as a sign of active exploitation ↗
- →Alert on HTTP/2 servers becoming completely unavailable after receiving a small number of HTTP/2 frame packets — exploitation requires only a few frames, making volumetric thresholds ineffective; focus on session destructor crashes ↗
- →Flag insufficient limitations on CONTINUATION frames within a single HTTP/2 stream — monitor for streams with an abnormally high number of CONTINUATION frames from unauthenticated remote clients ↗
- ·All active Node.js release lines are affected: 18.x, 20.x, and 21.x ↗
- ·The race condition is triggered during Http2Session destruction while CONTINUATION/header frames are still being processed in memory — detection must account for the transient nature of the crash (server returns to normal after attack ends) ↗
- ·Red Hat found no practical mitigation other than patching; once an attack ends the system should recover on its own ↗
- ·Exploitation is unauthenticated and remote, requiring only HTTP/2 protocol access — no credentials or prior access needed ↗
CVSS provenance
nvdv3.08.2HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
osv8.2HIGH
vendor_debian8.2HIGH
vendor_msrc8.2HIGH
vendor_oracle8.2HIGH
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Node.js) — CVE-2024-27983
vendor_oracle·2025-01-15·CVSS 8.2
CVE-2024-27983 [HIGH] Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Node.js) — CVE-2024-27983
Oracle Oracle JD Edwards Risk Matrix: E1 Dev Platform Tech - Cloud (Node.js) vulnerability
CVE: CVE-2024-27983
CVSS: 8.2
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
CISA ICS
Siemens SINEC INS
cisa_ics·2024-11-14
Siemens SINEC INS
ICS Advisory
##
Siemens SINEC INS
Release DateNovember 14, 2024
Alert CodeICSA-24-319-08
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.9
- ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerabilities: Improper Authentication, Out-of-bounds Write, Ineffici
Oracle
Oracle Oracle Java SE Risk Matrix: Node (Node.js) — CVE-2024-27983
vendor_oracle·2024-07-15·CVSS 8.2
CVE-2024-27983 [HIGH] Oracle Oracle Java SE Risk Matrix: Node (Node.js) — CVE-2024-27983
Oracle Oracle Java SE Risk Matrix: Node (Node.js) vulnerability
CVE: CVE-2024-27983
CVSS: 8.2
Protocol: HTTP/2
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2024 (JUL 2024)
Microsoft
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 m
vendor_msrc·2024-04-09·CVSS 8.2
CVE-2024-27983 [HIGH] An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 m
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of th
Red Hat
nodejs: CONTINUATION frames DoS
vendor_redhat·2024-04-03·CVSS 8.2
CVE-2024-27983 [HIGH] CWE-400 nodejs: CONTINUATION frames DoS
nodejs: CONTINUATION frames DoS
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
A vulnerability was found in how Node.js implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated, remote attacker to send packets to vulnerable server
Debian
CVE-2024-27983: nodejs - An attacker can make the Node.js HTTP/2 server completely unavailable by sending...
vendor_debian·2024·CVSS 8.2
CVE-2024-27983 [HIGH] CVE-2024-27983: nodejs - An attacker can make the Node.js HTTP/2 server completely unavailable by sending...
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
Scope: local
bookworm: resolved (fixed in 18.20.4+dfsg-1~deb12u1)
bullseye: resolved (fixed in 12.22.12~dfsg-1~deb11u5)
forky: resolved (fixed in 18.20.1+dfsg-1)
sid: resolved (fixed in 18.20.1+dfsg-1)
trixie: resolved (fixed in 18.20.1+dfsg-1)
OSV
CVE-2024-27983: An attacker can make the Node
osv·2024-04-09·CVSS 8.2
CVE-2024-27983 [HIGH] CVE-2024-27983: An attacker can make the Node
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
GHSA
GHSA-j65r-8hrg-qc6x: An attacker can make the Node
ghsa_unreviewed·2024-04-09
CVE-2024-27983 [HIGH] CWE-362 GHSA-j65r-8hrg-qc6x: An attacker can make the Node
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
New HTTP/2 DoS attack can crash web servers with a single connection
blogs_bleepingcomputer·2024-04-04
New HTTP/2 DoS attack can crash web servers with a single connection
## New HTTP/2 DoS attack can crash web servers with a single connection
## Bill Toulas
Newly discovered HTTP/2 protocol vulnerabilities called "CONTINUATION Flood" can lead to denial of service (DoS) attacks, crashing web servers with a single TCP connection in some implementations.
HTTP/2 is an update to the HTTP protocol standardized in 2015, designed to improve web performance by introducing binary framing for efficient data transmission, multiplexing to allow multiple requests and responses over a single connection, and header compression to reduce overhead
The new CONTINUATION Flood vulnerabilities were discovered by researcher Barket Nowotarski , who says that it relates to the use of HTTP/2 CONTINUATION frames, which are not properly limited or checked in many implementations of
HackerOne
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
hackerone·2024-04-29·CVSS 8.2
[HIGH] Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
Assertion failed in node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
* Advisory: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases
* HackerOne report: 2319584
## Impact
Server crashes instantly after sending a few HTTP/2 frames.
Assertion failed in node::http2::Http2Session
http://www.openwall.com/lists/oss-security/2024/04/03/16https://hackerone.com/reports/2319584https://lists.fedoraproject.org/archives/list/[email protected]/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/https://lists.fedoraproject.org/archives/list/[email protected]/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/https://security.netapp.com/advisory/ntap-20240510-0002/http://www.openwall.com/lists/oss-security/2024/04/03/16https://hackerone.com/reports/2319584https://lists.debian.org/debian-lts-announce/2024/09/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/JDECX4BYZLMM4S4LALN4DPZ2HUTTPLKE/https://lists.fedoraproject.org/archives/list/[email protected]/message/YDVFUH7ACZPYB3BS4SVILNOY7NQU73VW/https://security.netapp.com/advisory/ntap-20240510-0002/https://www.kb.cert.org/vuls/id/421644
2024-04-09
Published