Read the docs
TI-2024-20685 Aliases CVE-2024-31309GHSA-7hpg-wrjj-gghq

Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack

Priority HIGH 83CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.94615 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Traffic Server8.0.0 – 8.1.9; 9.0.0 – 9.2.3—No fix listedCNA
  • Apache Traffic Server VendorApache Affected 8.0.0 – 8.1.9; 9.0.0 – 9.2.3 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*8.0.0 to before 8.1.10; 9.0.0 to before 9.2.4VulnerableApache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*39VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*40VulnerableFedoraproject
  • cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* Versions 8.0.0 to before 8.1.10; 9.0.0 to before 9.2.4 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-31309
  2. 2026-10-03 Alias added: GHSA-7hpg-wrjj-gghq

References

Advisory 5

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2019-06950 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2019-06949 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2019-06947 Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2023-20588 Apache Traffic Server: Malformed http/2 frames can cause an abort CVSS 3.1HIGH 7.5
  • TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
See all 120 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences