Apache Traffic Server Vulnerable to HTTP/2 CONTINUATION DoS Attack

CVE-2024-31309

What is CVE-2024-31309?

A vulnerability exists in Apache Traffic Server that allows for a Denial of Service (DoS) attack via HTTP/2 CONTINUATION frames. This can lead to increased resource consumption on the server, particularly affecting versions from 8.0.0 to 8.1.9 and from 9.0.0 to 9.2.3. The issue can be mitigated by configuring the limit on CONTINUATION frames with the setting 'proxy.config.http2.max_continuation_frames_per_minute'. Users are strongly recommended to upgrade to the fixed versions 8.1.10 or 9.2.4 to eliminate this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References