Newly discovered HTTP/2 protocol vulnerabilities called "CONTINUATION Flood" can lead to denial of service (DoS) attacks, crashing web servers with a single TCP connection in some implementations. HTTP/2 is an update to the HTTP protocol standardized in 2015, designed to improve web performance by introducing binary framing for efficient data transmission, multiplexing to allow multiple requests and responses over a single connection, and header compression to reduce overhead The new CONTINUATION Flood vulnerabilities were discovered by researcher Barket Nowotarski, who says that it relates to the use of HTTP/2 CONTINUATION frames, which are not properly limited or checked in many implementations of the protocol. HTTP/2 messages include header and trailer sections serialized into blocks. These blocks can be fragmented across multiple frames for transmission, and the CONTINUATION frames are used for stitching the stream. The omission of proper frame checks in many implementations allows threat actors to potentially send an extremely long string of frames by simply not setting the 'END_HEADERS' flag, leading to server outages due to out-of-memory crashes or CPU resource exhaustion as these frames are processed. The researcher warned that out of memory conditions could lead to server crashes using a single HTTP/2 TCP connection in some implementations. "Out of Memory are probably the most boring yet severe cases. There is nothing special about it: no strange logic, no interesti...
New HTTP/2 DoS attack can crash web servers with a single connection
Affected Software
Frequently Asked Questions
What is the main topic of this article?
The article discusses a newly discovered vulnerability in the HTTP/2 protocol that allows attackers to conduct denial of service (DoS) attacks.
What security implications are discussed?
The vulnerabilities can crash web servers with a single TCP connection in certain implementations, leading to potential service disruptions.
What products or software are affected?
Affected software includes HTTP/2 implementations from vendors such as Red Hat, SUSE Linux, Arista Networks, Apache, nghttp2, Node.js, AMPHP, and Go programming language.
How does the CONTINUATION Flood attack work?
The CONTINUATION Flood attack exploits specific weaknesses in the HTTP/2 protocol to overwhelm the server and crash it using minimal resources.
What should organizations do to protect against this vulnerability?
Organizations should monitor their web servers for unusual traffic patterns and apply patches or updates provided by vendors to mitigate the risk of this attack.