Apache Traffic Server Vulnerable to HTTP/2 CONTINUATION DoS Attack

CVE-2024-31309

Summary

A vulnerability exists in Apache Traffic Server that allows for a Denial of Service (DoS) attack via HTTP/2 CONTINUATION frames. This can lead to increased resource consumption on the server, particularly affecting versions from 8.0.0 to 8.1.9 and from 9.0.0 to 9.2.3. The issue can be mitigated by configuring the limit on CONTINUATION frames with the setting 'proxy.config.http2.max_continuation_frames_per_minute'. Users are strongly recommended to upgrade to the fixed versions 8.1.10 or 9.2.4 to eliminate this vulnerability.

References