Description

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

INFO

Published Date :

2024-04-10T12:07:16.975Z

Last Modified :

2025-11-04T18:30:48.185Z

Source :

apache
AFFECTED PRODUCTS

The following products are affected by CVE-2024-31309 vulnerability.

Vendors Products
Apache
  • Traffic Server
Debian
  • Debian Linux
Fedoraproject
  • Fedora
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-31309.

URL Resource
http://www.openwall.com/lists/oss-security/2024/04/03/16 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2024/04/10/7 cve-icon cve-icon
https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/[email protected]/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/[email protected]/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/[email protected]/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-31309 cve-icon
https://www.kb.cert.org/vuls/id/421644 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact