CVE-2024-31309

CWE-20 — Improper Input ValidationCWE-400 — Uncontrolled Resource Consumption6 documents6 sources
Severity
7.5HIGH
EPSS
3.7%
top 12.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Apache Traffic ServerApache Software Foundation Apache Traffic ServerDebian Debian Linux+1 more
Timeline
PublishedApr 10

Description

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDapache/traffic_server8.0.0 — 8.1.10+1
▶Debiantrafficserver< 8.1.10+ds-1~deb11u1+1

Also affects: Debian Linux 10.0, Fedora 38, 39, 40

🔴Vulnerability Details

3
CVEList
Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack↗2024-04-10
▶
OSV
CVE-2024-31309: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server↗2024-04-10
▶
GHSA
GHSA-7hpg-wrjj-gghq: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server↗2024-04-10
▶

📋Vendor Advisories

2
Red Hat
trafficserver: CONTINUATION frames DoS↗2024-04-03
▶
Debian
CVE-2024-31309: trafficserver - HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more r...↗2024
▶