CVE-2024-31309: Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.maxcontinuationframesperminute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Other sources
The Apache Traffic Server's implementation of HTTP/2 will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set ENDHEADERS flag, resulting in an OOM crash.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.4+ds-0+deb12u1 - Upgrade
Upgrade
debian/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.5+ds-0+deb12u4 - Upgrade
Upgrade
redhat/trafficserverto a version that resolves this vulnerability.Fixed in 8.1.10 - Upgrade
Upgrade
redhat/trafficserverto a version that resolves this vulnerability.Fixed in 9.2.4 - Upgrade
Upgrade
alpine/trafficserver9to a version that resolves this vulnerability.Fixed in 9.2.4-r0 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 8.1.10 - Upgrade
Upgrade
Apache Traffic Serverto a version that resolves this vulnerability.Fixed in 9.2.4 - Configuration
Set proxy.config.http2.max_continuation_frames_per_minute to limit the number of HTTP/2 CONTINUATION frames per minute
Apache Traffic Server proxy.config.http2.max_continuation_frames_per_minute
Event History
Frequently Asked Questions
What is the severity of CVE-2024-31309?
CVE-2024-31309 has a moderate severity level as it may lead to a denial of service (DoS) attack on Apache Traffic Server.
How does CVE-2024-31309 affect Apache Traffic Server?
CVE-2024-31309 can cause increased resource consumption on the server due to excessive HTTP/2 CONTINUATION frames.
How do I fix CVE-2024-31309?
To fix CVE-2024-31309, set the proxy.config.http2.max_continuation_frames_per_minute configuration to limit the number of CONTINUATION frames.
Which versions of Apache Traffic Server are affected by CVE-2024-31309?
CVE-2024-31309 affects Apache Traffic Server versions from 8.0.0 to 8.1.9 and from 9.0.0 to 9.2.3.
What is the mitigation for CVE-2024-31309?
The primary mitigation for CVE-2024-31309 is to adjust the server configuration to impose limits on the rate of CONTINUATION frames.