HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
03 Jun 2025, 21:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2024/04/03/16 - Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2024/04/10/7 - Mailing List | |
| References | () https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc - Mailing List, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/ - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/ - Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/ - Third Party Advisory | |
| CPE | cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* |
|
| First Time |
Fedoraproject
Apache Fedoraproject fedora Debian Apache traffic Server Debian debian Linux |
|
| CWE | NVD-CWE-noinfo |
13 Feb 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue. |
Information
Published : 2024-04-10 12:15
Updated : 2025-06-03 21:11
NVD link : CVE-2024-31309
Mitre link : CVE-2024-31309
CVE.ORG link : CVE-2024-31309
JSON object : View
Products Affected
apache
- traffic_server
fedoraproject
- fedora
debian
- debian_linux
CWE