HTTP/2 CONTINUATION Flood: New Vulnerability Threatens the Entire Internet

Attention, Admins: Your Servers May Be at Risk!

If you were hoping for a quiet week, we have bad news. Security researchers have just disclosed a new and potentially devastating vulnerability in the HTTP/2 protocol. It's called "CONTINUATION Flood" (tracked as CVE-2025-43177), and it looks likely to cause serious trouble.

How Does the "CONTINUATION Flood" Attack Work?

In short, HTTP/2, which powers a large part of the modern internet, has a weakness. An attacker can send a server a series of specially crafted packets (CONTINUATION frames) that never properly end. As the server tries to process this endless stream of data, it uses up all available RAM and CPU. The server then hangs or stops working entirely.

Worst of all, this attack requires just one connection and one computer. No botnet army is needed to take down even a powerful machine. That makes "CONTINUATION Flood" an extremely dangerous tool for DoS (Denial of Service) attacks.

What Does the Attack Look Like, Step by Step?

To better understand what's happening under the hood, let's walk through a simplified attack scenario. Picture it as a conversation between a client and a server:

1. Establishing the connection: The attacker connects to the target server over HTTP/2. This is the standard, harmless start of any session.
2. Sending headers: The attacker starts sending a request, beginning with a HEADERS frame. Think of it as starting a letter by writing the recipient's address. The key technical detail is that the attacker does not set the END_HEADERS flag in this frame. This tells the server: "Hey, that's not all the headers yet. I'll send the rest in the next few packets!"
3. Flooding with continuations: Instead of finishing the headers, the attacker sends an unbroken stream of additional CONTINUATION frames. None of them carries the END_HEADERS flag either.
4. Resource exhaustion: The server dutifully accepts every CONTINUATION frame, assembles them in memory, and waits for an end signal that never comes. Memory (RAM) runs out almost immediately and the CPU hits 100%. The result is a server crash and a denial of service for real users.

The "genius" of this attack lies in abusing a legitimate protocol feature for malicious ends, which makes it hard for traditional security systems to detect.

Who Is Vulnerable?

The issue affects many popular HTTP/2 implementations. The list of vulnerable technologies includes:

• Node.js
• Apache HTTP Server
• Envoy
• Tempesta FW
• And many other libraries and servers.

If you manage web infrastructure, there's a good chance this issue affects you too.

What Should You Do?

Fortunately, software vendors have already responded, and updates and patches that fix this critical flaw are available. The advice is simple: update your server software immediately! Waiting could cost you service stability and a lot of stress.

It looks like a busy stretch of patching and hardening is ahead of us. Stay alert!

Source: BleepingComputer

Aleksander

See also: Record-Breaking DDoS Attack Powered by IoT Devices and The Complete Guide to Zero-Day Vulnerabilities.