QID 87552

QID 87552: Apache Traffic Server Denial of Service (DoS) Vulnerability (CVE-2024-31309)

Apache Traffic Server is a fast, scalable and extensible HTTP/1.1 and HTTP/2.0 compliant caching proxy server.

CVE-2024-31309: ATS is vulnerable to a HTTP/2 CONTINUATION frame flooding attack.

Version Affected:
ATS 8.0.0 to 8.1.9
ATS 9.0.0 to 9.2.3

QID Detection Logic:
This unauthenticated QID relies on the version reported by the ATS service.

Successful exploitation of this vulnerability can cause Apache Traffic Server to consume more resources on the server.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as High - 7.8 severity.

Solution

Customers are advised to upgrade to Apache Traffic Server or later versions to remediate these vulnerabilities.

Workaround:
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.

Vendor References

Apache Traffic Server Reference - lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc

CVEs related to QID 87552

CVE-2024-31309 |

Software Advisories

Advisory ID	Software	Component	Link
Apache Traffic Server Reference			lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].