CVE-2024-3302

What it actually does

Absence of any limit on the number of HTTP/2 CONTINUATION frames processed allows a remote server to trigger unbounded memory allocation in the browser client, resulting in an out-of-memory condition.

Why it matters to the business

Users of affected browsers may experience crashes or freezes when visiting malicious or compromised sites, disrupting productivity and requiring restarts or support intervention.

How an attack unfolds

An attacker hosts or compromises a web server that, upon connection from a vulnerable browser, sends a large number of HTTP/2 CONTINUATION frames without the END_HEADERS flag to exhaust client memory.

How to fix it

Upgrade Firefox to version 125 or later, Firefox ESR to 115.10 or later, and Thunderbird to 115.10 or later. Ensure automatic updates are enabled and verify installed versions after patching.

How to confirm the fix worked

Confirm browser versions meet or exceed the fixed releases listed above; test by visiting a controlled HTTP/2 endpoint that emits multiple CONTINUATION frames and verify the client remains stable.

Typical attack path

1. Attacker sets up or compromises a web server capable of crafting HTTP/2 traffic
2. Victim browser connects to the malicious endpoint over HTTP/2
3. Server transmits an unbounded stream of CONTINUATION frames
4. Browser allocates memory for each frame until an out-of-memory error occurs
5. Browser tab or process crashes or becomes unresponsive

How to detect it

Review browser process memory usage and crash reports for sudden spikes or OOM events correlated with visits to unknown domains; inspect network captures for HTTP/2 streams containing unusually high numbers of CONTINUATION frames.

What your security team should do

• Prioritize deployment of the fixed browser versions across all managed endpoints
• Enable automatic update mechanisms and monitor update compliance
• Educate users to avoid untrusted sites until patches are applied