http2 continuation frame attack

bfenetworks / bfe

A modern layer 7 load balancer from baidu

https://www.bfe-networks.net

Apache License 2.0

6.12k stars 946 forks source link

Closed z8n24 closed 4 months ago

z8n24 commented 4 months ago

最近爆出来的http2 协议的 CONTINUATION 帧攻击（CVE-2023-45288）。发现BFE 同样有. 通过循环CONTINUATION 帧发送，可以打满CPU的情况。