CVE-2024-27316

HIGH

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-27316 has a selected CVSS score of 7.5 (high); EIP currently links 2 repository PoCs and 1 lab environment.

Description

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Lab environments
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 29, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Apache HTTP Server

Browse Apache Software Foundation / Apache HTTP Server

Default status: unaffected

CVE List2.4.17 to ≤ 2.4.58affected

http_server

Browse apache / http_server

Default status: unknown

CVE List2.4.17 to ≤ 2.4.58affected

Proofs of concept

2

Repository PoCs

GitHublockness-Ko/CVE-2024-27316Repository PoCby lockness-Ko18Not analyzed6 files

22.2 KiB · linked to 6 vulnerabilities

GitHub
PoC details
GitHubaeyesec/CVE-2024-27316_pocRepository PoCby aeyesec2Not analyzed8 files

12.4 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

docker-compose.yml

aeyesec/CVE-2024-27316_pocCreated Vuln labCVE-2024-27316Compose · builds

1 Compose manifest · 2 Dockerfiles · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that runs two Apache httpd containers (v2.4.58 and v2.4.59) with HTTP/2 enabled, alongside a Node.js PoC script that sends a flood of HTTP/2 CONTINUATION frames to demonstrate CVE-2024-27316.

docker-compose.yml:1-17README.md:1-39

Lab assessment

Vulnerability lab

The README explicitly states it is a PoC for CVE-2024-27316, and the environment provides a vulnerable (2.4.58) and a fixed (2.4.59) Apache httpd server with HTTP/2 enabled, along with a script that sends a CONTINUATION flood to trigger the vulnerability.

README.md:1README.md:3README.md:7README.md:13
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles2
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

cve-2024-27316_v2458

vulnerable target server

Apache httpd 2.4.58 container with HTTP/2 enabled, exposed on host ports 3392 (HTTP) and 3393 (HTTPS). It is the vulnerable version for the PoC.

docker-compose.yml:4-9httpd-2_4_58/Dockerfile:1-25README.md:7

cve-2024-27316_v2459

fixed target server

Apache httpd 2.4.59 container with HTTP/2 enabled, exposed on host ports 3394 (HTTP) and 3395 (HTTPS). It is the patched version for comparison.

docker-compose.yml:10-16httpd-2_4_59/Dockerfile:1-25README.md:13

poc.js

exploit script

A Node.js script that connects to the target server, performs an HTTP/2 handshake, and sends a large number of CONTINUATION frames with oversized header names to trigger a CONTINUATION flood. It targets the vulnerable server by default.

poc.js:1-181README.md:33-36
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2024-27316

Supported by supplied evidence

The environment is explicitly labeled as a PoC for CVE-2024-27316, provides a vulnerable Apache httpd 2.4.58 and a fixed 2.4.59, and the PoC script implements a CONTINUATION flood attack consistent with the CVE description.

README.md:1README.md:7README.md:13poc.js:1-181
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the target servers.README.md:5-6
  • Node.js and npm must be installed to run the PoC script.README.md:33-36
  • The npm dependencies (hpack.js) must be installed via 'npm ci'.README.md:34package.json:11-13

Evidence-described exercise path

  1. Start the target servers using 'docker-compose up -d'.README.md:5-6
  2. Verify connectivity to the vulnerable server (v2.4.58) using curl with HTTP/2.README.md:9-10
  3. Verify connectivity to the fixed server (v2.4.59) using curl with HTTP/2.README.md:15-16
  4. Check resource status of the containers with 'docker stats'.README.md:20-21
  5. Install Node.js dependencies with 'npm ci'.README.md:34
  6. Run the PoC script with 'node poc.js' to send a CONTINUATION flood to the vulnerable server.README.md:35poc.js:1-181
  7. Stop the servers with 'docker-compose down'.README.md:25-26
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The PoC script only connects to localhost on the mapped ports of the lab containers and sends HTTP/2 frames. It does not attempt to escape the container, access the host filesystem, exfiltrate data, or establish persistence. The Docker Compose file does not use privileged mode or mount sensitive host directories. All behavior is directed at the intended lab targets.

poc.js:14-17poc.js:68-72docker-compose.yml:1-17
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

Showing 12 of 13