CVE-2024-27983
Published: 09 April 2024
Summary
CVE-2024-27983 is a high-severity Race Condition (CWE-362) vulnerability in Fedoraproject (inferred from references). Its CVSS base score is 8.2 (High).
Operationally, ranked in the top 1.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a race condition (CWE-362) in Node.js HTTP/2 server handling that affects the nghttp2 library. When a client sends headers using HTTP/2 CONTINUATION frames and then abruptly closes the TCP connection, the Http2Session destructor can be triggered while frames are still being processed and stored in memory, leaving residual data and rendering the server unavailable.
Remote attackers with no authentication required can exploit the flaw by transmitting a small number of crafted HTTP/2 frames. Successful exploitation produces high availability impact and limited integrity impact, allowing an unauthenticated adversary to crash or hang the HTTP/2 server.
Advisories published via openwall, Fedora package lists, and NetApp reference the underlying HackerOne report and indicate that updated Node.js packages containing fixes are being distributed to address the issue.
The EPSS score stands at 0.7593 with a recorded peak of 0.7662, reflecting substantial and sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-25157
Vulnerability details
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with…
more
HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Accurate timestamps from internal clocks enable detection of race conditions by providing reliable event ordering in audit logs.
Coordination of concurrent security activities reduces the probability that shared resources will be accessed simultaneously without proper synchronization.