Blog

What you should know: HTTP/2 CONTINUATION Flood Vulnerability 

8 min.

April 10, 2024

A new class of vulnerabilities in specific implementations of the HTTP/2 protocol, dubbed “HTTP/2 CONTINUATION Flood,” has been discovered, causing concern across the Internet. Various affected products have already been identified and assigned CVEs, with more expected to be disclosed in the future. This vulnerability is potentially even more severe than the previous HTTP/2 Rapid Reset issue. 

Key points 

  • A new class of vulnerabilities: “HTTP/2 CONTINUATION Flood” has been discovered in various implementations of the HTTP/2 protocol. 
  • The vulnerability can lead to Denial of Service (DoS) attacks and is considered more severe than the previous HTTP/2 Rapid Reset vulnerability. 
  • Several affected products have been identified and assigned CVEs, with more expected to be disclosed in the future. 
  • The vulnerability arises when a single large HEADER frame is insufficient to store all the headers, and the data stream continues with CONTINUATION frames without the END_HEADERS flag set. 
  • Disclosures and fixes were coordinated together with CERT/CC 

Understanding the HTTP/2 CONTINUATION Flood Vulnerability 

About HTTP/2 

HTTP/2 (RFC9204) is an updated version of the HTTP protocol that allows multiple streams of data to be sent simultaneously over a single TCP connection. The data is binary-encoded into frames, with different frame types designed for specific purposes. 

Two crucial frame types are HEADERS and CONTINUATION frames, which are used to send header fields in requests and responses. 

The headers are divided and serialized into “header lists” for transmission within HEADERS frames, while CONTINUATION frames are used to continue the sequence of headers in the data stream. 

HTTP/2 CONTINUATION Flood 

The vulnerability occurs when an attacker crafts a malicious request that never sets the END_HEADERS flag, creating an infinite stream of headers that the HTTP/2 server must parse and store in memory. As the server struggles to process the incoming headers, it becomes unavailable and may eventually crash due to an Out of Memory (OOM) error. 

Potential outcomes of this vulnerability include: 

  • CPU exhaustion, causing slowness in responding to other requests. 
  • Out of Memory crashes.  
  • Server crashes.  

Comparison to Rapid Reset and Other CVEs 

The impact of the CONTINUATION Flood vulnerability is potentially more severe than the previous Rapid Reset vulnerability for two main reasons. 

  1. Exploitation often requires only a single TCP connection and minimal data, making it easier to execute than Rapid Reset, which often requires a DDoS approach. 
  1. The attack is harder to detect and protect against using standard mitigations, as not even a single request is made due to the absence of the END_HEADERS flag. 

Known Affected Products and CVEs 

Numerous Internet services already implement version 2 of HTTP which could present a risk to the Internet safety, and that’s why disclosures and fixes of the most critical services were coordinated with CERT/CC

Multiple CVEs have been assigned: 

Project  Confirmed  Affected Versions  CVE ID 
amphp/http  2024-03-11  >= 2.0.0 && <= 2.1.0, <= 1.7.2  CVE-2024-2653 
Apache HTTP Server (httpd)  2024-02-23  2.4.17-2.4.58  CVE-2024-27316 
Apache Tomcat  2024-01-25  <=11.0.0-M16, <=10.1.18, <=9.0.85, 8.5.0-8.5.98  CVE-2024-24549 
Apache Traffic Server  2024-03-29  8.0.0-8.1.9, 9.0.0-9.2.3  CVE-2024-31309 
github.com/envoyproxy/envoy (oghttp)  2024-02-27  1.29.0, 1.29.1  CVE-2024-27919 
github.com/envoyproxy/envoy (nghttp2)  2024-02-27  <=1.29.2  CVE-2024-30255 
Golang  2024-01-10  <=1.20, <=1.21.8, <=1.22.1  CVE-2023-45288 
h2 Rust crate  2024-03-04  <=0.4.3, <=v0.3.25   
nghttp2  2024-03-08  <=1.60.0  CVE-2024-28182 
Node.js  2024-01-15  <=18.20.0, <=20.12.0, <=21.7.1  CVE-2024-27983 
Tempesta FW  2024-03-16  0.7.0  CVE-2024-2758 
█████████ ***  2024-04-04    CVE-2024-XXXX 
█████████  2024-04-04    CVE-2024-XXXX 

Mitigation

In HTTP/1.1, servers are protected from infinite headers by enforcing header size limits and request/headers timeouts that drop the connection.

So, to mitigate the CONTINUATION Flood vulnerability, vendors must limit or sanitize the number of CONTINUATION frames sent within a single stream. Some vendors have already released fixes, while others are working on patches. 

CVE-2024-2653

Affects the amphp/http Composer package. Fixed in versions 1.7.3 and 2.1.1 with commit 881cc33d.

More information here

CVE-2024-27316

Affects Apache HTTP Server (httpd). Fixed in version 2.4.59 with commit b646741f.

More information here

CVE-2024-24549

Affects Apache Tomcat. Fixed in versions 8.5.99, 9.0.86, 10.1.19 and 11.0.0-M17 with commit 810f49d5.

Note that this CVE is not directly related to the CONTINUATION flaw but was discovered as a consequence of a POC for the vulnerability.

More information here

CVE-2024-31309

Affects Apache Traffic Server. Fixed in versions  8.1.10-rc0 and 9.2.4-rc0 with commit b8c6a23b.

More information here

CVE-2024-27919

Affects the Go package github.com/envoyproxy/envoy through the “oghttp” component. Fixed in versions 1.26.8, 1.27.4, 1.28.2 and 1.29.3 with commit d1936d03.

More information here

CVE-2024-30255

Affects the Go package github.com/envoyproxy/envoy through the “nghttp2” component. Fixed in versions 1.26.8, 1.27.4, 1.28.2 and 1.29.3.

More information here

CVE-2023-45288

Fixed in the Go packages golang.org/x/net/http2 version 0.23.0 and net/http 1.21.9 and 1.22.2 with commit ba872109.

More information here

CVE-2024-28182

Affects the Cpp library and Go wrapper nghttp2. Fixed in version 1.61.0 with commit 00201ecd.

More information here

CVE-2024-27983

Affect Node.js. Fixed in versions 18.20.1, 20.12.1 and 21.7.2.

More information here

CVE-2024-2758

Affects Tempesta FW. Fixed in version 0.7.1.

Our team is actively tracking these vulnerabilities and ensuring that our SCA solution covers the affected products within its scope.

More information here

We maintain a comprehensive list of advisories on our DevHub page at https://devhub.checkmarx.com/advisories/. (A resource that provides timely information and insights about various SCA vulnerabilities).

Conclusion

The HTTP/2 CONTINUATION Flood vulnerabilities present a critical issue that can cause significant disruption to web servers.

This class of vulnerabilities is a reminder that while new protocols offer improvements, their implementations must be carefully designed and tested to ensure security.

Checkmarx is actively tracking these vulnerabilities and their impact on the open-source domain. 

Our SCA solution covers these vulnerabilities within its scope, helping organizations identify and mitigate potential risks.