Apache HTTP Server 2.4.17-2.4.58 - Denial of Service via HTTP/2 Header Buffering
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-27316. PoCs published by lockness-Ko, aeyesec.
AI-analyzed exploit summary This Go-based PoC exploits CVE-2024-27316, a DoS vulnerability in HTTP/2 servers by sending maliciously crafted HEADERS and CONTINUATION frames with excessively large headers. It supports both HTTP and HTTPS targets and spawns multiple threads to amplify the attack.
Description
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Exploits (2)
This Go-based PoC exploits CVE-2024-27316, a DoS vulnerability in HTTP/2 servers by sending maliciously crafted HEADERS and CONTINUATION frames with excessively large headers. It supports both HTTP and HTTPS targets and spawns multiple threads to amplify the attack.
This PoC demonstrates a DoS attack against Apache httpd via HTTP/2 CONTINUATION flood (CVE-2024-27316). It establishes an HTTP/2 connection and sends a large number of CONTINUATION frames to exhaust server resources.
References (10)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H