Search for vulnerabilities
Vulnerability details: VCID-2tbb-56q4-aaae
Vulnerability ID VCID-2tbb-56q4-aaae
Aliases CVE-2024-31309
Summary HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-400 Uncontrolled Resource Consumption
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-31309.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02451 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02771 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.02807 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.04333 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.04333 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.04333 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.07184 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
epss 0.19891 https://api.first.org/data/v1/epss?cve=CVE-2024-31309
cvssv3.1 7.5 https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
ssvc Track https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
cvssv3.1 7.5 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2024/04/03/16
cvssv3.1 8.2 http://www.openwall.com/lists/oss-security/2024/04/03/16
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/04/03/16
ssvc Track http://www.openwall.com/lists/oss-security/2024/04/03/16
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2024/04/10/7
ssvc Track http://www.openwall.com/lists/oss-security/2024/04/10/7
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-31309.json
https://api.first.org/data/v1/epss?cve=CVE-2024-31309
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31309
https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
http://www.openwall.com/lists/oss-security/2024/04/03/16
http://www.openwall.com/lists/oss-security/2024/04/10/7
1068417 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068417
2269627 https://bugzilla.redhat.com/show_bug.cgi?id=2269627
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
CVE-2024-31309 https://nvd.nist.gov/vuln/detail/CVE-2024-31309
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-31309.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2024/04/10/7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-11-12T18:21:30Z/ Found at http://www.openwall.com/lists/oss-security/2024/04/10/7
Exploit Prediction Scoring System (EPSS)
Percentile 0.15162
EPSS Score 0.00045
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:19:42.985402+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-31309 34.0.0rc4