CVE-2024-30156

What it actually does

The flaw permits an attacker to exhaust credits in the HTTP/2 connection control flow window, stalling data transmission and causing denial of service on affected connections.

Why it matters to the business

Web caching services become unavailable or severely degraded, resulting in increased backend load, slower site performance, and potential downtime for dependent applications.

How an attack unfolds

An attacker opens an HTTP/2 connection to a vulnerable Varnish instance and transmits specially crafted frames that rapidly deplete flow-control window credits without allowing normal recovery, leaving the connection unusable.

How to fix it

Upgrade Varnish Cache to 7.3.2 or newer, 7.4.3 or newer, or 6.0.13 LTS; upgrade Varnish Enterprise 6 to 6.0.12r6 or newer. Apply the update and restart the service.

How to confirm the fix worked

Confirm the running Varnish version meets or exceeds the fixed releases, then perform HTTP/2 load tests to verify flow-control window credits are correctly managed and connections do not stall.

Typical attack path

1. Establish an HTTP/2 connection to the target Varnish server
2. Send a sequence of HTTP/2 frames engineered to drain window credits
3. Keep the depleted connection alive to block further legitimate traffic
4. Repeat across multiple connections to amplify resource exhaustion

How to detect it

Inspect Varnish access and error logs for HTTP/2 connections that remain open with no data transfer after initial frames; correlate with spikes in CPU or memory usage on the cache process.

What your security team should do

• Immediately schedule upgrades of all Varnish instances to the patched releases
• Apply temporary HTTP/2 rate limiting or connection throttling until patches are deployed
• Monitor EPSS and threat intelligence feeds for any future increase in exploitation activity