CVE-2024-31309
published 2024-04-10CVE-2024-31309: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through…
PriorityP264high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
94.62%
99.8th percentile
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | >= 8.0.0 < 8.1.10 | 8.1.10 |
| apache | traffic_server | >= 9.0.0 < 9.2.4 | 9.2.4 |
| apache_software_foundation | apache_traffic_server | 8.0.0 – 8.1.9 | — |
| apache_software_foundation | apache_traffic_server | 9.0.0 – 9.2.3 | — |
| debian | debian_linux | — | — |
| debian | trafficserver | < trafficserver 9.2.4+ds-0+deb12u1 (bookworm) | trafficserver 9.2.4+ds-0+deb12u1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect excessive HTTP/2 CONTINUATION frames sent within a single stream to Apache Traffic Server, which may indicate a CVE-2024-31309 DoS exploitation attempt. ↗
- →Monitor Apache Traffic Server versions 8.0.0–8.1.9 and 9.0.0–9.2.3 for anomalous resource consumption (CPU/memory spikes) correlated with HTTP/2 traffic, as these ranges are confirmed vulnerable. ↗
- ·A new configuration knob `proxy.config.http2.max_continuation_frames_per_minute` can be set to rate-limit CONTINUATION frames per minute as a mitigation short of patching. ↗
- ·ATS enforces a fixed memory cap per request; this pre-existing limit provides partial protection but does not fully prevent resource exhaustion from CONTINUATION frame floods. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-31309: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server
osv·2024-04-10·CVSS 7.5
CVE-2024-31309 [HIGH] CVE-2024-31309: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
GHSA
GHSA-7hpg-wrjj-gghq: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server
ghsa_unreviewed·2024-04-10
CVE-2024-31309 [HIGH] CWE-20 GHSA-7hpg-wrjj-gghq: HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Red Hat
trafficserver: CONTINUATION frames DoS
vendor_redhat·2024-04-03·CVSS 7.5
CVE-2024-31309 [HIGH] CWE-400 trafficserver: CONTINUATION frames DoS
trafficserver: CONTINUATION frames DoS
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
A vulnerability was found in how Apache Traffic Server implements the HTTP/2 protocol. There are insufficient limitations placed on the amount of CONTINUATION frames that can be sent within a single stream. This issue could allow an unauthenticated
Debian
CVE-2024-31309: trafficserver - HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more r...
vendor_debian·2024·CVSS 7.5
CVE-2024-31309 [HIGH] CVE-2024-31309: trafficserver - HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more r...
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Scope: local
bookworm: resolved (fixed in 9.2.4+ds-0+deb12u1)
bullseye: resolved (fixed in 8.1.10+ds-1~deb11u1)
sid: resolved (fixed in 9.2.4+ds-1)
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2024/04/03/16http://www.openwall.com/lists/oss-security/2024/04/10/7https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kchttps://lists.debian.org/debian-lts-announce/2024/04/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/https://lists.fedoraproject.org/archives/list/[email protected]/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/https://lists.fedoraproject.org/archives/list/[email protected]/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/http://www.openwall.com/lists/oss-security/2024/04/03/16http://www.openwall.com/lists/oss-security/2024/04/10/7https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kchttps://lists.debian.org/debian-lts-announce/2024/04/msg00021.htmlhttps://lists.fedoraproject.org/archives/list/[email protected]/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/https://lists.fedoraproject.org/archives/list/[email protected]/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/https://lists.fedoraproject.org/archives/list/[email protected]/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/https://www.kb.cert.org/vuls/id/421644
2024-04-10
Published