--- title: "What you should know: HTTP/2 CONTINUATION Flood Vulnerability" date: "2024-04-10T13:22:02+00:00" url: "https://checkmarx.com/blog/what-you-should-know-http-2-continuation-flood-vulnerability/" description: "A new class of vulnerabilities in specific implementations of the HTTP/2 protocol, dubbed \"HTTP/2 CONTINUATION Flood,\" has been discovered, causing concern across the Internet." --- # What you should know: HTTP/2 CONTINUATION Flood Vulnerability A new class of vulnerabilities in specific implementations of the HTTP/2 protocol, dubbed “HTTP/2 CONTINUATION Flood,” has been discovered, causing concern across the Internet. Various affected products have already been identified and assigned CVEs, with more expected to be disclosed in the future. This vulnerability is potentially even more severe than the previous HTTP/2 Rapid Reset issue. ## **Key points** - A new class of vulnerabilities: “HTTP/2 CONTINUATION Flood” has been discovered in various implementations of the HTTP/2 protocol. - The vulnerability can lead to Denial of Service (DoS) attacks and is considered more severe than the previous HTTP/2 Rapid Reset vulnerability. - Several affected products have been identified and assigned CVEs, with more expected to be disclosed in the future. - The vulnerability arises when a single large HEADER frame is insufficient to store all the headers, and the data stream continues with CONTINUATION frames without the END\_HEADERS flag set. - Disclosures and fixes were coordinated together with CERT/CC ## **Understanding the HTTP/2 CONTINUATION Flood Vulnerability** ### **About HTTP/2** HTTP/2 (RFC9204) is an updated version of the HTTP protocol that allows multiple streams of data to be sent simultaneously over a single TCP connection. The data is binary-encoded into frames, with different frame types designed for specific purposes. Two crucial frame types are HEADERS and CONTINUATION frames, which are used to send header fields in requests and responses. The headers are divided and serialized into “header lists” for transmission within HEADERS frames, while CONTINUATION frames are used to continue the sequence of headers in the data stream. ### **HTTP/2 CONTINUATION Flood** The vulnerability occurs when an attacker crafts a malicious request that never sets the END\_HEADERS flag, creating an infinite stream of headers that the HTTP/2 server must parse and store in memory. As the server struggles to process the incoming headers, it becomes unavailable and may eventually crash due to an Out of Memory (OOM) error. Potential outcomes of this vulnerability include: - CPU exhaustion, causing slowness in responding to other requests. - Out of Memory crashes. - Server crashes. ## **Comparison to Rapid Reset and Other CVEs** The impact of the CONTINUATION Flood vulnerability is potentially more severe than the previous Rapid Reset vulnerability for two main reasons. 1. Exploitation often requires only a single TCP connection and minimal data, making it easier to execute than Rapid Reset, which often requires a DDoS approach. 2. The attack is harder to detect and protect against using standard mitigations, as not even a single request is made due to the absence of the END\_HEADERS flag. ## **Known Affected Products and CVEs** Numerous Internet services already implement version 2 of HTTP which could present a risk to the Internet safety, and that’s why disclosures and fixes of the most critical services were coordinated with [CERT/CC](https://kb.cert.org/vuls/). Multiple CVEs have been assigned: **Project** **Confirmed** **Affected Versions** **CVE ID** [amphp/http](https://amphp.org/http) 2024-03-11 >= 2.0.0 && <= 2.1.0, <= 1.7.2 CVE-2024-2653 [Apache HTTP Server (httpd)](https://httpd.apache.org/) 2024-02-23 2.4.17-2.4.58 CVE-2024-27316 [Apache Tomcat](https://tomcat.apache.org/) 2024-01-25 <=11.0.0-M16, <=10.1.18, <=9.0.85, 8.5.0-8.5.98 CVE-2024-24549 [Apache Traffic Server](https://trafficserver.apache.org/) 2024-03-29 8.0.0-8.1.9, 9.0.0-9.2.3 CVE-2024-31309 [github.com/envoyproxy/envoy](https://envoyproxy.io/) (oghttp) 2024-02-27 1.29.0, 1.29.1 CVE-2024-27919 [github.com/envoyproxy/envoy](https://envoyproxy.io/) (nghttp2) 2024-02-27 <=1.29.2 CVE-2024-30255 [Golang](https://go.dev/) 2024-01-10 <=1.20, <=1.21.8, <=1.22.1 CVE-2023-45288 h2 Rust crate2024-03-04 <=0.4.3, <=v0.3.25 [nghttp2](https://nghttp2.org/) 2024-03-08 <=1.60.0 CVE-2024-28182 [Node.js](https://nodejs.org/) 2024-01-15 <=18.20.0, <=20.12.0, <=21.7.1 CVE-2024-27983 [Tempesta FW](https://github.com/tempesta-tech/tempesta) 2024-03-16 0.7.0 CVE-2024-2758 █████████ \*\*\* 2024-04-04 CVE-2024-XXXX █████████ 2024-04-04 CVE-2024-XXXX ## **Mitigation** In HTTP/1.1, servers are protected from infinite headers by enforcing header size limits and request/headers timeouts that drop the connection. So, to mitigate the CONTINUATION Flood vulnerability, vendors must limit or sanitize the number of CONTINUATION frames sent within a single stream. Some vendors have already released fixes, while others are working on patches. ### **CVE-2024-2653** Affects the amphp/http Composer package. Fixed in versions 1.7.3 and 2.1.1 with commit [881cc33d](https://github.com/amphp/http/commit/881cc33da236fbcd0cb0cf6c2bfc7efcf80ede76). More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-2653/). ### **CVE-2024-27316** Affects Apache HTTP Server (httpd). Fixed in version 2.4.59 with commit [b646741f](https://github.com/apache/httpd/commit/b646741ff0aea194a72903c3a824a877dc61b8c6). More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-27316/). ### **CVE-2024-24549** Affects Apache Tomcat. Fixed in versions 8.5.99, 9.0.86, 10.1.19 and 11.0.0-M17 with commit [810f49d5](https://github.com/apache/tomcat/commit/810f49d5ff6d64b704af85d5b8d0aab9ec3c83f5). Note that this CVE is not directly related to the CONTINUATION flaw but was discovered as a consequence of a POC for the vulnerability. More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-24549/). ### **CVE-2024-31309** Affects Apache Traffic Server. Fixed in versions 8.1.10-rc0 and 9.2.4-rc0 with commit [b8c6a23b](https://github.com/apache/trafficserver/commit/b8c6a23b74af1772e5cb0de25b38c234a418cb1d). More information [here](https://devhub.checkmarx.com/cve-details/%20CVE-2024-31309/). ### **CVE-2024-27919** Affects the Go package github.com/envoyproxy/envoy through the “oghttp” component. Fixed in versions 1.26.8, 1.27.4, 1.28.2 and 1.29.3 with commit [d1936d03](https://github.com/envoyproxy/envoy/commit/d1936d03463eea4ea547b19dc5252307c0542092). More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-27919/). ### **CVE-2024-30255** Affects the Go package github.com/envoyproxy/envoy through the “nghttp2” component. Fixed in versions 1.26.8, 1.27.4, 1.28.2 and 1.29.3. More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-30255/). ### **CVE-2023-45288** Fixed in the Go packages golang.org/x/net/http2 version 0.23.0 and net/http 1.21.9 and 1.22.2 with commit [ba872109.](https://github.com/golang/net/commit/ba872109ef2dc8f1da778651bd1fd3792d0e4587) More information [here](https://devhub.checkmarx.com/cve-details/CVE-2023-45288/). ### **CVE-2024-28182** Affects the Cpp library and Go wrapper nghttp2. Fixed in version 1.61.0 with commit [00201ecd](https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0). More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-28182/). ### **CVE-2024-27983** Affect Node.js. Fixed in versions 18.20.1, 20.12.1 and 21.7.2. More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-27983/). ### **CVE-2024-2758** Affects Tempesta FW. Fixed in version 0.7.1. Our team is actively tracking these vulnerabilities and ensuring that our SCA solution covers the affected products within its scope. More information [here](https://devhub.checkmarx.com/cve-details/CVE-2024-2758/). We maintain a comprehensive list of advisories on our DevHub page at [https://devhub.checkmarx.com/advisories/](https://devhub.checkmarx.com/advisories/). (A resource that provides timely information and insights about various SCA vulnerabilities). ## **Conclusion** The HTTP/2 CONTINUATION Flood vulnerabilities present a critical issue that can cause significant disruption to web servers. This class of vulnerabilities is a reminder that while new protocols offer improvements, their implementations must be carefully designed and tested to ensure security. Checkmarx is actively tracking these vulnerabilities and their impact on the open-source domain. Our SCA solution covers these vulnerabilities within its scope, helping organizations identify and mitigate potential risks.