Cybersecurity researchers have recently discovered a new vulnerability in the HTTP/2 protocol, which allows threat actors to mount denial of service (DoS) attacks and even crash servers with a single TCP connection.
The vulnerability relates to the use of HTTP/2 CONTINUATION frames, which is why the researcher who found it, Barket Nowotarski, dubbed it “CONTINUATION Flood”.
As explained by BleepingComputer, HTTP/2 is the updated version of the HTTP protocol, standardized in 2015. Its goal was to improve web performance by introducing binary framing for efficient data transmission, multiplexing which allowed multiple requests and responses over a single connection, and header compression which reduced overhead.
Multiple CVEs
With HTTP/2 messages, header and trailer sections are serialized and placed into blocks, which can later be fragmented for transmission. CONTINUATION frames are then used to stitch them together, but thanks to the lack of proper frame checks, a threat actor can send too long of a frame. The CPU can end up crashing in an attempt to process these frames.
“Out of Memory are probably the most boring yet severe cases. There is nothing special about it: no strange logic, no interesting race condition and so on,” Nowotarski said. “The implementations that allow OOM simply did not limit the size of headers list built using CONTINUATION frames.”
“Implementations without header timeout required just a single HTTP/2 connection to crash the server.”
Depending on the implementation of HTTP/2, the vulnerabilities are tracked under a different CVE. Some are more disruptive than others, and can result in DoS attacks, memory leaks, memory consumption, and more:
CVE-2024-27983, CVE-2024-27919, CVE-2024-2758, CVE-2024-2653, CVE-2023-45288, CVE-2024-28182, CVE-2024-27316, CVE-2024-31309, and CVE-2024-30255.
Red Hat, SUSE Linux, Arista Networks, Apache HTTP Server Project, nghttp2, Node.js, AMPHP, and the Go Programming Language, have all since confirmed being vulnerable to at least one of these CVEs, BleepingComputer found.
