Description
HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected.
Users can set a new setting (proxy.config.http2.max_continuation_frames_per_minute) to limit the number of CONTINUATION frames per minute. ATS does have a fixed amount of memory a request can use and ATS adheres to these limits in previous releases.
Users are recommended to upgrade to versions 8.1.10 or 9.2.4 which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Traffic Server | 8.0.0 – ≤ 8.1.9, 9.0.0 – ≤ 9.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | trafficserver | 9.2.4+ds-0+deb12u1 | DSA-5659-1 |
| Debian 11 | trafficserver | 8.1.10+ds-1~deb11u1 | DSA-5659-1 |
| Debian 10 | trafficserver | 8.1.7-0+deb10u4 | DLA-3799-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | trafficserver | No fix yet | — |
| Ubuntu 18.04 LTS | trafficserver | No fix yet | — |
| Ubuntu 16.04 LTS | trafficserver | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | trafficserver | No fix yet | — |
| Ubuntu Pro 20.04 LTS | trafficserver | No fix yet | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | trafficserver9 | 9.2.4-r0 | — |
| Alpine v3.23 | trafficserver9 | 9.2.4-r0 | — |
| Alpine v3.22 | trafficserver9 | 9.2.4-r0 | — |
| Alpine v3.21 | trafficserver9 | 9.2.4-r0 | — |
Advisories 3
- WID-SEC-2024-0789 HTTP/2: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Oct 15, 2026
- DSA-5659-1 trafficserver - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3799-1 trafficserver - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://lists.apache.org/thread/f9qh3g3jvy153wh82pz4onrfj1wh13kc vendor-advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QV77HYM7ARSTL3B6U3IFG7PHDU65WL4I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T3XON6RM5ZKCZ6K6NB7BOTAWMJQKXJDO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PBKLPQ6ECG4PGEPRCYI3Y3OITNDEFCCV/
- https://lists.debian.org/debian-lts-announce/2024/04/msg00021.html
- http://www.openwall.com/lists/oss-security/2024/04/03/16
- http://www.openwall.com/lists/oss-security/2024/04/10/7