Apache Traffic Server 8.0-9.2 DoS via HTTP/2 CONTINUATION (CVE-2024-31309)
CVE-2024-31309 Published on April 10, 2024
Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Vulnerability Analysis
CVE-2024-31309 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Products Associated with CVE-2024-31309
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-31309 are published in these products:
Affected Versions
Apache Software Foundation Apache Traffic Server:- Version 8.0.0, <= 8.1.9 is affected.
- Version 9.0.0, <= 9.2.3 is affected.
- Version 8.0.0, <= 8.1.9 is affected.
- Version 9.0.0, <= 9.2.3 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.