CVE-2024-30156

Отчет

CVE-2024-30156 represents a important severity issue due to its potential to cause widespread denial of service (DoS) across Varnish Cacher servers with HTTP/2 protocol enabled. By exploiting this vulnerability, attackers can exhaust the server's HTTP/2 connection control flow window credits, thereby halting the processing of streams and indefinitely retaining associated resources. This can lead to a complete service outage, impacting the availability and performance of web services relying on Varnish Cache. Given the prevalence of HTTP/2 adoption for its performance benefits, the vulnerability poses a significant risk to web infrastructure, necessitating immediate mitigation measures to prevent exploitation and mitigate the impact on affected systems.

Меры по смягчению последствий

A possible mitigation for this issue is to disable http2 support until the package can be updated. This can be performed by running the following command:

Note: you must remove h2 from the list of protocols if your TLS terminator is advertising it with ALPN. It's also possible to use the MAIN.sc_bankrupt counter to monitor possible on-going attacks to the varnish server.