CVE-2024-31309
Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
CVE-2024-31309- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2024-29205
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
EUVD-2024-29205- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-7hpg-wrjj-gghq
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the...
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
GHSA-7hpg-wrjj-gghq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
CVE-2024-31309- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVALPINE-CVE-2024-31309
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
ALPINE-CVE-2024-31309- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
CVE-2024-31309- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-31309
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
DEBIAN-CVE-2024-31309- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-31309
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
- Record
UBUNTU-CVE-2024-31309- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
trafficserver9Alpine:v3.21 |
before 9.2.4-r0 | 9.2.4-r0 |
trafficserver9Alpine:v3.22 |
before 9.2.4-r0 | 9.2.4-r0 |
trafficserver9Alpine:v3.23 |
before 9.2.4-r0 | 9.2.4-r0 |
trafficserver9Alpine:v3.24 |
before 9.2.4-r0 | 9.2.4-r0 |
trafficserverDebian:12 |
before 9.2.4+ds-0+deb12u1, plus listed versions 9.2.0+ds-29.2.0+ds-2+deb12u19.2.1+ds-19.2.2+ds-19.2.3+ds-19.2.3+ds-1+deb12u1 |
9.2.4+ds-0+deb12u1 |
trafficserverDebian:10 |
before 8.1.7-0+deb10u4, plus listed versions 8.0.2+ds-18.0.2+ds-1+deb10u18.0.2+ds-1+deb10u28.0.2+ds-1+deb10u38.0.2+ds-1+deb10u4 Show 24 moreShow less8.0.2+ds-1+deb10u58.0.2+ds-1+deb10u68.0.2+ds-1+deb10u78.0.3+ds-18.0.3+ds-28.0.3+ds-38.0.3+ds-48.0.5+ds-18.0.5+ds-28.0.5+ds-38.0.6+ds-18.0.7+ds-18.0.8+ds-18.0.8+ds-28.1.0+ds-18.1.0+ds-28.1.1+ds-18.1.1+ds-1.18.1.5+ds-1~deb11u18.1.6+ds-1~deb10u18.1.6+ds-1~deb11u18.1.7-0+deb10u18.1.7-0+deb10u28.1.7-0+deb10u3 |
8.1.7-0+deb10u4 |
trafficserverDebian:11 |
before 8.1.10+ds-1~deb11u1, plus listed versions 8.1.1+ds-1.18.1.1+ds-1.1+deb11u18.1.5+ds-1~deb11u18.1.6+ds-1~deb10u18.1.6+ds-1~deb11u18.1.7+ds-1~deb11u18.1.9+ds-1~deb11u1 |
8.1.10+ds-1~deb11u1 |
trafficserverUbuntu:16.04:LTS |
All versions, plus listed versions 5.3.0-2ubuntu15.3.0-2ubuntu2 |
None known |
trafficserverUbuntu:18.04:LTS |
All versions, plus listed versions 7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3 |
None known |
trafficserverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 8.0.5+ds-18.0.5+ds-28.0.5+ds-2build18.0.5+ds-2ubuntu18.0.5+ds-38.0.5+ds-3ubuntu0.1~esm1 |
None known |
trafficserverUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 8.1.1+ds-1.19.1.1+ds-2build19.1.1+ds-2ubuntu0.1~esm19.1.1+ds-2ubuntu0.19.1.1+ds-2ubuntu0.1+esm1 |
None known |
trafficserverUbuntu:24.04:LTS |
All versions, plus listed versions 9.2.1+ds-1build19.2.2+ds-19.2.3+ds-19.2.3+ds-1+deb12u19.2.3+ds-1+deb12u1build19.2.3+ds-1+deb12u1build39.2.3+ds-1+deb12u1build49.2.3+ds-1+deb12u1ubuntu0.1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-31309 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published April 10, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 94.6%, the 99th percentile. Fixed in trafficserver9 9.2.4-r0.
References
lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
lists.fedoraproject.org/archives/list/[email protected]/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I
lists.debian.org/debian-lts-announce/2024/04/msg00021.html
openwall.com/lists/oss-security/2024/04/03/16
Show 12 moreShow less
kb.cert.org/vuls/id/421644
nvd.nist.gov/vuln/detail/CVE-2024-31309
github.com/advisories/GHSA-7hpg-wrjj-gghq
security.alpinelinux.org/vuln/CVE-2024-31309
security-tracker.debian.org/tracker/CVE-2024-31309
ubuntu.com/security/CVE-2024-31309
bugzilla.redhat.com/show_bug.cgi?id=2269627
cve.org/CVERecord?id=CVE-2024-31309