What you should know: HTTP/2 CONTINUATION Flood Vulnerability 

A new class of vulnerabilities in specific implementations of the HTTP/2 protocol, dubbed "HTTP/2 CONTINUATION Flood," has been discovered, causing concern across the Internet. Various affected products have already been identified and assigned CVEs, with more expected to be disclosed in the future. This vulnerability is potentially even more severe than the previous HTTP/2 Rapid Reset issue. 

Key points 

  • A new class of vulnerabilities: "HTTP/2 CONTINUATION Flood" has been discovered in various implementations of the HTTP/2 protocol. 
  • The vulnerability can lead to Denial of Service (DoS) attacks and is considered more severe than the previous HTTP/2 Rapid Reset vulnerability. 
  • Several affected products have been identified and assigned CVEs, with more expected to be disclosed in the future. 
  • The vulnerability arises when a single large HEADER frame is insufficient to store all the headers, and the data stream continues with CONTINUATION frames without the END_HEADERS flag set. 
  • Disclosures and fixes were coordinated together with CERT/CC 

Understanding the HTTP/2 CONTINUATION Flood Vulnerability 

About HTTP/2 

HTTP/2 (RFC9204) is an updated version of the HTTP protocol that allows multiple streams of data to be sent simultaneously over a single TCP connection. The data is binary-encoded into frames, with different frame types designed for specific purposes. 

Two crucial frame types are HEADERS and CONTINUATION frames, which are used to send header fields in requests and responses. 

The headers are divided and serialized into "header lists" for transmission within HEADERS frames, while CONTINUATION frames are used to continue the sequence of headers in the data stream. 


The vulnerability occurs when an attacker crafts a malicious request that never sets the END_HEADERS flag, creating an infinite stream of headers that the HTTP/2 server must parse and store in memory. As the server struggles to process the incoming headers, it becomes unavailable and may eventually crash due to an Out of Memory (OOM) error. 

Potential outcomes of this vulnerability include: 

  • CPU exhaustion, causing slowness in responding to other requests. 
  • Out of Memory crashes.  
  • Server crashes.  

Comparison to Rapid Reset and Other CVEs 

The impact of the CONTINUATION Flood vulnerability is potentially more severe than the previous Rapid Reset vulnerability for two main reasons. 

  1. Exploitation often requires only a single TCP connection and minimal data, making it easier to execute than Rapid Reset, which often requires a DDoS approach. 
  1. The attack is harder to detect and protect against using standard mitigations, as not even a single request is made due to the absence of the END_HEADERS flag. 

Known Affected Products and CVEs 

Numerous Internet services already implement version 2 of HTTP which could present a risk to the Internet safety, and that’s why disclosures and fixes of the most critical services were coordinated with CERT/CC

Multiple CVEs have been assigned: 

Project Confirmed Affected Versions CVE ID 
amphp/http 2024-03-11 >= 2.0.0 && <= 2.1.0, <= 1.7.2 CVE-2024-2653 
Apache HTTP Server (httpd) 2024-02-23 2.4.17-2.4.58 CVE-2024-27316 
Apache Tomcat 2024-01-25 <=11.0.0-M16, <=10.1.18, <=9.0.85, 8.5.0-8.5.98 CVE-2024-24549 
Apache Traffic Server 2024-03-29 8.0.0-8.1.9, 9.0.0-9.2.3 CVE-2024-31309 (oghttp) 2024-02-27 1.29.0, 1.29.1 CVE-2024-27919 (nghttp2) 2024-02-27 <=1.29.2 CVE-2024-30255 
Golang 2024-01-10 <=1.20, <=1.21.8, <=1.22.1 CVE-2023-45288 
h2 Rust crate 2024-03-04 <=0.4.3, <=v0.3.25  
nghttp2 2024-03-08 <=1.60.0 CVE-2024-28182 
Node.js 2024-01-15 <=18.20.0, <=20.12.0, <=21.7.1 CVE-2024-27983 
Tempesta FW 2024-03-16 0.7.0 CVE-2024-2758 
█████████ *** 2024-04-04  CVE-2024-XXXX 
█████████ 2024-04-04  CVE-2024-XXXX 


In HTTP/1.1, servers are protected from infinite headers by enforcing header size limits and request/headers timeouts that drop the connection.

So, to mitigate the CONTINUATION Flood vulnerability, vendors must limit or sanitize the number of CONTINUATION frames sent within a single stream. Some vendors have already released fixes, while others are working on patches. 


Affects the amphp/http Composer package. Fixed in versions 1.7.3 and 2.1.1 with commit 881cc33d.

More information here


Affects Apache HTTP Server (httpd). Fixed in version 2.4.59 with commit b646741f.

More information here


Affects Apache Tomcat. Fixed in versions 8.5.99, 9.0.86, 10.1.19 and 11.0.0-M17 with commit 810f49d5.

Note that this CVE is not directly related to the CONTINUATION flaw but was discovered as a consequence of a POC for the vulnerability.

More information here


Affects Apache Traffic Server. Fixed in versions  8.1.10-rc0 and 9.2.4-rc0 with commit b8c6a23b.

More information here


Affects the Go package through the “oghttp” component. Fixed in versions 1.26.8, 1.27.4, 1.28.2 and 1.29.3 with commit d1936d03.

More information here


Affects the Go package through the “nghttp2” component. Fixed in versions 1.26.8, 1.27.4, 1.28.2 and 1.29.3.

More information here


Fixed in the Go packages version 0.23.0 and net/http 1.21.9 and 1.22.2 with commit ba872109.

More information here


Affects the Cpp library and Go wrapper nghttp2. Fixed in version 1.61.0 with commit 00201ecd.

More information here


Affect Node.js. Fixed in versions 18.20.1, 20.12.1 and 21.7.2.

More information here


Affects Tempesta FW. Fixed in version 0.7.1.

Our team is actively tracking these vulnerabilities and ensuring that our SCA solution covers the affected products within its scope.

More information here

We maintain a comprehensive list of advisories on our DevHub page at (A resource that provides timely information and insights about various SCA vulnerabilities).


The HTTP/2 CONTINUATION Flood vulnerabilities present a critical issue that can cause significant disruption to web servers.

This class of vulnerabilities is a reminder that while new protocols offer improvements, their implementations must be carefully designed and tested to ensure security.

Checkmarx is actively tracking these vulnerabilities and their impact on the open-source domain. 

Our SCA solution covers these vulnerabilities within its scope, helping organizations identify and mitigate potential risks.

About the Author

About the Author

Never miss an update. Subscribe today!

By submitting my information to Checkmarx, I hereby consent to the terms and conditions found in the Checkmarx Privacy Policy and to
the processing of my personal data as described therein. By clicking submit below, you consent to allow Checkmarx
to store and process the personal information submitted above to provide you the content requested.
Skip to content