# Exploiting HTTP/2 CONTINUATION frames for DoS attacks

DevFeed: [Exploiting HTTP/2 CONTINUATION frames for DoS attacks](<https://devfeed.tech/articles/exploiting-http-2-continuation-frames-for-dos-attacks-7912.md>)

Original publisher: [Read original article](<https://snyk.io/blog/exploiting-http-2-continuation-frames-dos-attacks/>)

Author: Vandana Verma Sehgal

Published: 2024-04-08T05:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [DDoS](<https://devfeed.tech/topics/ddos.md>), [servers](<https://devfeed.tech/topics/servers.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Go Language](<https://devfeed.tech/topics/go-language.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [code-security](<https://devfeed.tech/tags/code-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [devrel](<https://devfeed.tech/tags/devrel.md>), [enablement](<https://devfeed.tech/tags/enablement.md>), [engineering](<https://devfeed.tech/tags/engineering.md>), [go](<https://devfeed.tech/tags/go.md>), [http](<https://devfeed.tech/tags/http.md>), [http-server](<https://devfeed.tech/tags/http-server.md>), [internet-traffic](<https://devfeed.tech/tags/internet-traffic.md>), [js](<https://devfeed.tech/tags/js.md>), [monitor](<https://devfeed.tech/tags/monitor.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [open-source-security](<https://devfeed.tech/tags/open-source-security.md>), [performance](<https://devfeed.tech/tags/performance.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-platform](<https://devfeed.tech/tags/snyk-platform.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

This article explains a vulnerability in HTTP/2 implementations that lets attackers flood a single stream with excessive CONTINUATION frames, potentially overwhelming or crashing web servers. It describes the affected ecosystem, including Node.js and Go, and recommends patching, rate limiting, traffic monitoring, and temporarily disabling HTTP/2 when no patch is available.

## Source excerpt

This post covers all the info you need on the new HTTP/2 CONTINUATION frames vulnerability, including the affected versions, its impact, mitigation steps, and how to protect your applications.