CVE-2024-31309

7.5 HIGH
Published: April 10, 2024 Modified: November 04, 2025
View on NVD

Description

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/03/16
Source: security@apache.org
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/10/7
Source: security@apache.org
Mailing List
https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
Source: security@apache.org
Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
Source: security@apache.org
Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
Source: security@apache.org
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
Source: security@apache.org
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
Source: security@apache.org
Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/04/03/16
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/10/7
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.kb.cert.org/vuls/id/421644
Source: af854a3a-2127-422b-91ae-364da2661108

15 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.5 / 10.0
EPSS (Exploit Probability)
2.8%
86th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

apache debian fedoraproject

Related CVEs

CVE-2025-69261 N/A
CVE-2025-69257 6.7
CVE-2025-69210 N/A
CVE-2025-66823 N/A
CVE-2025-50343 N/A