CVE-2024-31309

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-31309

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-31309.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-31309

Related

Published

2024-04-10T12:15:09Z

Modified

2024-11-12T20:48:05.378718Z

Summary

[none]

Details

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.

Users can set a new setting (proxy.config.http2.maxcontinuationframesperminute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

References

Affected packages

Debian:11 / trafficserver

Package

Name: trafficserver
Purl: pkg:deb/debian/trafficserver?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.1.10+ds-1~deb11u1

Affected versions

8.*

8.1.1+ds-1.1

8.1.1+ds-1.1+deb11u1

8.1.5+ds-1~deb11u1

8.1.6+ds-1~deb10u1

8.1.6+ds-1~deb11u1

8.1.7+ds-1~deb11u1

8.1.9+ds-1~deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / trafficserver

Package

Name: trafficserver
Purl: pkg:deb/debian/trafficserver?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

9.2.4+ds-0+deb12u1

Affected versions

9.*

9.2.0+ds-2

9.2.0+ds-2+deb12u1

9.2.1+ds-1

9.2.2+ds-1

9.2.3+ds-1

9.2.3+ds-1+deb12u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}