HTTP/2 stalled flow-control denial-of-service in Apache Traffic Server and other HTTP/2 servers

CVE-2026-44909 is a class of HTTP/2 denial-of-service abuses tracked under CERT/CC VU#885548 ("stalled flow-control"). A remote unauthenticated client opens one or many streams, advertises a small or zero WINDOW_UPDATE, and never consumes buffered response bytes. Origin servers behind the proxy keep generating response data, the HTTP/2 endpoint keeps buffering it waiting for the client to open its window, and RAM runs out. Confirmed affected: Apache Traffic Server (fixed in 9.2.14 and 10.1.3 by hard-enforcing proxy.config.http2.max_active_streams_in with REFUSED_STREAM), plus advisories in progress from Citrix NetScaler ADC/Gateway, F5 BIG-IP, nginx, apache2, and Meta / Red Hat / SUSE / Yahoo stacks.

There is no vendor CVSS baseline — this is a *first assessment*. The bug is architecturally similar to Rapid Reset (CVE-2023-44487) and MadeYouReset in that it abuses HTTP/2 protocol semantics rather than an implementation memory-safety bug, so any TLS-terminating HTTP/2 proxy is a candidate. It is availability-only — no code execution, no data disclosure — but the affected footprint is the load-balancer and CDN tier that fronts every public app, and the attack requires no authentication and cheap client resources.

Why this verdict

• Unauthenticated + remote + network vector — no credentials, no user interaction, no prior foothold required. This alone keeps the baseline elevated.
• Role multiplier: the affected components are canonically network-edge appliances and reverse proxies (F5 BIG-IP, Citrix NetScaler, Apache Traffic Server, nginx). The chain succeeds against every deployment role — there is no benign role for these components. Blast radius = every application fronted by that node → tenant-scale to fleet-scale outage.
• Availability-only impact caps the verdict — no confidentiality/integrity loss, no lateral movement, no code execution. This is the reason the verdict is HIGH and not CRITICAL.
• Friction: cost to attacker is low, cost to defender is high — a single attacker box with an h2 client can stall gigabytes of proxy RAM. Rate limits at L4 don't help because the traffic volume is tiny.
• No KEV, no public PoC yet — but the class (Rapid Reset lineage) has been weaponized within weeks of past disclosures, so the exploitation-timeline expectation is short.

Why not higher?

CRITICAL is reserved for chains ending in code execution, credential theft, or data exfiltration. This is a memory-exhaustion DoS; a successful attack takes the service offline but leaves the substrate intact. Recovery is a process restart, not a rebuild.

Why not lower?

MEDIUM would ignore that the affected components are the load-balancer tier for entire enterprises — a single node outage takes down every app behind it. MEDIUM would also ignore the unauthenticated network vector. The role multiplier forbids dropping below HIGH.

1. Hard-cap per-connection HTTP/2 concurrent streams — Set SETTINGS_MAX_CONCURRENT_STREAMS to ≤ 100 and enforce synchronously. On ATS pre-9.2.14, set proxy.config.http2.max_active_streams_in low AND deploy an nginx/Envoy sidecar that enforces it hard. Deploy within 30 days per noisgate mitigation SLA for HIGH.
2. Enable per-connection memory accounting / overload manager — On Envoy, configure overload_manager with envoy.resource_monitors.fixed_heap thresholds. On nginx, cap http2_recv_buffer_size and http2_max_field_size. On BIG-IP, apply the HTTP/2 profile memory limits per F5 KB when the advisory ships. Deploy within 30 days.
3. Idle/stall timeout on HTTP/2 streams — Terminate streams where the client has not consumed DATA within N seconds (typically 10–30s). Kills the flow-control-stall pattern at the root.
4. Front the proxy tier with a CDN that already mitigated the class — Cloudflare, Fastly, Akamai patched analogous flow-control bugs post-Rapid Reset. Terminating h2 at the CDN edge shifts the memory-exhaustion risk to a provider whose per-connection accounting is battle-tested.
5. Upgrade Apache Traffic Server to 9.2.14 or 10.1.3 — The remediation path. Track vendor advisories at CERT/CC VU#885548 for NetScaler, BIG-IP, nginx, apache2 and schedule production upgrades within the noisgate remediation SLA of 180 days.

Run on each Apache Traffic Server node as root or the trafficserver service user. Invoke: sudo bash check-cve-2026-44909.sh. For non-ATS proxies, replace the version probe with the vendor's equivalent (e.g., nginx -v, tmsh show sys version on BIG-IP).

#!/usr/bin/env bash
# noisgate verification for CVE-2026-44909 (HTTP/2 stalled flow-control DoS)
# Target: Apache Traffic Server. Extend for other h2 proxies as needed.
set -u

VULN=0
UNKNOWN=0

if ! command -v traffic_server >/dev/null 2>&1; then
  echo "traffic_server binary not found — this host may not run ATS"
  UNKNOWN=1
else
  RAW=$(traffic_server -V 2>&1 | head -n1)
  # Expected format: "Apache Traffic Server - traffic_server - 10.1.3 - ..."
  VER=$(echo "$RAW" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
  if [ -z "$VER" ]; then
    echo "Could not parse ATS version from: $RAW"
    UNKNOWN=1
  else
    MAJOR=$(echo "$VER" | cut -d. -f1)
    MINOR=$(echo "$VER" | cut -d. -f2)
    PATCH=$(echo "$VER" | cut -d. -f3)
    echo "Detected ATS version: $VER"
    # Fixed: 9.2.14+ on 9.2.x line, 10.1.3+ on 10.x line
    if [ "$MAJOR" -eq 9 ] && [ "$MINOR" -eq 2 ] && [ "$PATCH" -lt 14 ]; then
      VULN=1
    elif [ "$MAJOR" -eq 10 ]; then
      if [ "$MINOR" -lt 1 ] || { [ "$MINOR" -eq 1 ] && [ "$PATCH" -lt 3 ]; }; then
        VULN=1
      fi
    elif [ "$MAJOR" -lt 9 ]; then
      VULN=1
    fi
  fi
fi

# Secondary check: is HTTP/2 enabled and is the stream cap set low?
CONF="/etc/trafficserver/records.config"
[ -f /opt/ts/etc/trafficserver/records.config ] && CONF=/opt/ts/etc/trafficserver/records.config
if [ -f "$CONF" ]; then
  STREAMS=$(grep -E '^\s*CONFIG\s+proxy\.config\.http2\.max_active_streams_in' "$CONF" | awk '{print $NF}')
  echo "proxy.config.http2.max_active_streams_in = ${STREAMS:-unset}"
fi

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE"
  exit 2
elif [ "$UNKNOWN" -eq 1 ]; then
  echo "UNKNOWN"
  exit 1
else
  echo "PATCHED"
  exit 0
fi

Sources

1. CERT/CC VU#885548 — HTTP/2 stalled flow-control DoS
2. Apache Traffic Server security advisories
3. CVE Project cvelistV5
4. IETF RFC 9113 — HTTP/2 (flow control semantics)
5. Rapid Reset class background (CVE-2023-44487)
6. Envoy overload manager documentation
7. nginx HTTP/2 module directives
8. F5 BIG-IP HTTP/2 profile reference