CVE-2024-31309 Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
Attackers can cause resource exhaustion and denial of service in Apache Traffic Server by sending excessive HTTP/2 CONTINUATION frames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-31309?
CVE-2024-31309 is a high-severity denial of service vulnerability in Apache Traffic Server, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Weakness: CWE-20
Which versions are affected by CVE-2024-31309?
It affects 3 products.
Products include Apache Traffic Server, Debian Debian Linux, Fedoraproject Fedora.
How do I fix CVE-2024-31309?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-31309 being exploited?
There is no known exploitation of CVE-2024-31309 in the wild and no public exploit code.
Other vulnerabilities in Apache Traffic Server
Sources
Also known as DEBIAN-CVE-2024-31309, DLA-3799-1, DSA-5659-1, GHSA-7hpg-wrjj-gghq, UBUNTU-CVE-2024-31309.