HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
References
Configurations
No configuration.
History
12 Nov 2024, 19:35
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
01 May 2024, 18:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
28 Apr 2024, 22:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
19 Apr 2024, 23:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
12 Apr 2024, 02:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary |
|
10 Apr 2024, 13:23
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-04-10 12:15
Updated : 2024-11-12 19:35
NVD link : CVE-2024-31309
Mitre link : CVE-2024-31309
CVE.ORG link : CVE-2024-31309
JSON object : View
Products Affected
No product.
CWE
CWE-20
Improper Input Validation