HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.

Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.02105.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Apache Software Foundation Apache Traffic Server unaffected
Version Status Constraints
8.0.0 affected
≤ 8.1.9
9.0.0 affected
≤ 9.2.3

Configuration 1 [-]

OR cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Configuration 3 [-]

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors Products
Apache Subscribe
Traffic Server Subscribe
Debian Subscribe
Debian Linux Subscribe
Fedoraproject Subscribe
Fedora Subscribe

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-3799-1 trafficserver security update
Debian DSA Debian DSA DSA-5659-1 trafficserver security update
EUVD EUVD EUVD-2024-29205 HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://www.openwall.com/lists/oss-security/2024/04/03/16 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2024/04/10/7 cve-icon cve-icon
https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-31309 cve-icon
https://www.kb.cert.org/vuls/id/421644 cve-icon
History

Tue, 04 Nov 2025 19:30:00 +0000

Type Values Removed Values Added
References

Wed, 04 Jun 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux
Fedoraproject
Fedoraproject fedora

Wed, 28 May 2025 17:00:00 +0000

Type Values Removed Values Added
References

Thu, 22 May 2025 02:45:00 +0000

Type Values Removed Values Added
References

Thu, 13 Feb 2025 18:00:00 +0000

Type Values Removed Values Added
Description HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue. HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

Tue, 12 Nov 2024 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache traffic Server
CPEs cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
Vendors & Products Apache
Apache traffic Server
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2025-11-04T18:30:48.185Z

Reserved: 2024-03-29T18:52:13.204Z

Link: CVE-2024-31309

cve-icon Vulnrichment

Updated: 2024-08-02T01:52:56.330Z

cve-icon NVD

Status : Modified

Published: 2024-04-10T12:15:09.257

Modified: 2025-11-04T19:17:08.067

Link: CVE-2024-31309

cve-icon Redhat

Severity : Important

Publid Date: 2024-04-03T00:00:00Z

Links: CVE-2024-31309 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses