CVE-2024-31309

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

• CWE-20

• https://www.openwall.com/lists/oss-security/2024/04/03/16Mailing List
• https://www.openwall.com/lists/oss-security/2024/04/10/7Mailing List
• https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kcMailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/Third Party Advisory
• https://www.openwall.com/lists/oss-security/2024/04/03/16Mailing List
• https://www.openwall.com/lists/oss-security/2024/04/10/7Mailing List
• https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kcMailing List, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/Third Party Advisory
• https://www.kb.cert.org/vuls/id/421644

Published

Apr 10, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31303Cross-Site Request Forgery (CSRF) vulnerability in Fetch Des…4.3
• CVE-2024-31304Missing Authorization vulnerability in MultiVendorX WC Marke…8.8
• CVE-2024-31305Cross-Site Request Forgery (CSRF) vulnerability in rtCamp Tr…4.3
• CVE-2024-31306Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-31307Missing Authorization vulnerability in appscreo Easy Social …6.3
• CVE-2024-31308Deserialization of Untrusted Data vulnerability in VJInfotec…7.2
• CVE-2024-3131A vulnerability was found in SourceCodester Computer Laborat…6.5
• CVE-2024-31310In newServiceInfoLocked of AutofillManagerServiceImpl.java, …7.8
• CVE-2024-31311In increment_annotation_count of stats_event.c, there is a p…7.8
• CVE-2024-31312In multiple locations, there is a possible information leak …5.5
• CVE-2024-31313In availableToWriteBytes of MessageQueueBase.h, there is a p…7.8
• CVE-2024-31314In multiple functions of ShortcutService.java, there is a po…5.5