Improper Input Validation
CVE-2024-31309
Summary
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Versions 5.1.0-rc0 through 8.1.9, and 9.0.0-rc0 through 9.2.3 are affected. Users can set a new setting ("proxy.config.http2.max_continuation_frames_per_minute") to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- NONE
- NONE
- HIGH
CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
References
Advisory Timeline
- Published
