CVE-2024-31309: Apache Traffic Server HTTP/2 CONTINUATION frame denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 availability-only impact with no authentication required, and an EPSS probability near 0.95, make this a high-priority patching target despite no KEV listing.

What it is

Apache Traffic Server versions 8.0.0 through 8.1.9 and 9.0.0 through 9.2.3 can be driven to consume excessive server resources via HTTP/2 CONTINUATION frames, an improper input validation issue (CWE-20). Because the attack is network-reachable with no authentication or user interaction, it can degrade or exhaust proxy capacity.

Impact

An unauthenticated remote attacker can cause resource exhaustion on the Traffic Server process, degrading or denying service to legitimate traffic. There is no confidentiality or integrity impact per the CVSS vector; only availability is affected.

Attack surface

Reached over the network through the HTTP/2 interface of Apache Traffic Server, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required; any client able to send HTTP/2 requests can attempt it.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record, but EPSS is very high (0.94615, 99.851st percentile), indicating elevated likelihood of attempted exploitation. References are vendor and distribution advisories only.

What to do

• Upgrade to Apache Traffic Server 8.1.10 or 9.2.4, which fix the issue.
• If immediate upgrade is not possible, set proxy.config.http2.max_continuation_frames_per_minute to limit CONTINUATION frames per minute.
• Apply the Debian LTS and Fedora package updates for Traffic Server where those distributions are in use.
• Rate-limit or filter HTTP/2 traffic at the edge and monitor per-connection CONTINUATION frame volume.
• Verify existing request memory limits are in place, since ATS enforces fixed per-request memory caps.

Detection

• Monitor Traffic Server logs and metrics for spikes in HTTP/2 CONTINUATION frames or abnormal per-connection frame counts.
• Alert on sustained increases in CPU, memory or connection counts on ATS nodes without matching legitimate traffic growth.
• Track HTTP/2 connections that send unusually high CONTINUATION frame volumes relative to HEADERS frames.
• Watch for repeated connection resets or timeouts from single source addresses against the HTTP/2 listener.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.