CVE-2024-30156

A flaw was found in the Varnish cache server, with HTTP/2 support enabled, that may allow a Denial of Service type of attack. A malicious actor can cause the server to run out of credits during the HTTP/2 connection control flow. As a consequence, the server will stop to properly process the active HTTP streams, retaining the already allocated resources, leading to resource starvation.

CVE-2024-30156 represents a important severity issue due to its potential to cause widespread denial of service (DoS) across Varnish Cacher servers with HTTP/2 protocol enabled. By exploiting this vulnerability, attackers can exhaust the server's HTTP/2 connection control flow window credits, thereby halting the processing of streams and indefinitely retaining associated resources. This can lead to a complete service outage, impacting the availability and performance of web services relying on Varnish Cache. Given the prevalence of HTTP/2 adoption for its performance benefits, the vulnerability poses a significant risk to web infrastructure, necessitating immediate mitigation measures to prevent exploitation and mitigate the impact on affected systems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A possible mitigation for this issue is to disable http2 support until the package can be updated. This can be performed by running the following command:

varnishadm param.set feature -http2

Note: you must remove h2 from the list of protocols if your TLS terminator is advertising it with ALPN.

It's also possible to use the MAIN.sc_bankrupt counter to monitor possible on-going attacks to the varnish server.