CVE-2024-31309

Katalog CVE

CVSS 7.5 · High EPSS 94,6%

Kerentanan Improper Input Validation pada apache traffic server, debian linux +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.  Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute.  ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases. Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.

Rincian

Terbit di NVD

10 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation

EPSS (30 hari)

94,6% peluang dieksploitasi; lebih tinggi dari 99,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc mailing list · advisory vendor
• https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html mailing list · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEP... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K... advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2024/04/03/16 mailing list
• http://www.openwall.com/lists/oss-security/2024/04/10/7 mailing list
• https://www.kb.cert.org/vuls/id/421644