PT-2024-2589 · Apache · Apache Traffic Server

Bartek Nowotarski · Published 2024-01-05 · Updated 2025-06-03 · CVE-2024-31309

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.3

Description The HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. This issue is related to the incorrect determination of the end of a header when processing CONTINUATION frames, which can lead to an uncontrolled consumption of resources. A remote attacker can exploit this issue by sending multiple HTTP packets, potentially causing a denial of service.

Recommendations For versions 8.0.0 through 8.1.9, upgrade to version 8.1.10. For versions 9.0.0 through 9.2.3, upgrade to version 9.2.4. As a temporary workaround, consider setting a new setting proxy.config.http2.max continuation frames per minute to limit the number of CONTINUATION frames per minute.

Fix

DoS

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-20

Related Identifiers

BDU:2024-02651

CVE-2024-31309

DLA-3799-1

DSA-5659-1

Affected Products

Apache Traffic Server

References · 35

• https://osv.dev/vulnerability/UBUNTU-CVE-2024-31309 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-31309 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5659-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-31309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31309 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-31309 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3799-1 · Vendor Advisory
• https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-31309 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02651 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-31309 · Security Note
• https://github.com/apache/trafficserver/commit/b8c6a23b74af1772e5cb0de25b38c234a418cb1d · Note