CVE-2024-31309

CVE-2024-31309: Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

Vendor Apache Software Foundation
Product Apache Traffic Server
Weakness CWE-20 · Input validation
Published April 10, 2024
Last update November 4, 2025
View on NVD All CVEs

CVSS base score

—

What the vulnerability does

Description

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

Key dates

Disclosure timeline

April 10, 2024 CVE published
November 4, 2025 Record updated