‹ Back to list

CVE-2024-2758

Status: DeferredMedium (6.3)—
Severity6.3Medium · CVSS 3.1
Exploitation probability73 %higher than 99% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately.

CVSS

Base score
6.3
Version
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
73 %
Percentile among all scored CVEs
99
Score date
10/23/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Tempesta — Tempesta FWAI

References

Show 6 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2024-2758",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-2758",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-04-03T18:54:02.766108Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "Tempesta",
          "product": "Tempesta FW",
          "versions": [
            {
              "status": "affected",
              "version": "0.7.0",
              "versionType": "custom",
              "lessThanOrEqual": "0.7.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-04-03T18:15:07.380",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16",
      "source": "cret@cert.org"
    },
    {
      "url": "https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4",
      "source": "cret@cert.org"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/421644",
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2024/04/03/16",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/tempesta-tech/tempesta/security/advisories/GHSA-3xwj-5ch3-q9p4",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/421644",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Tempesta FW rate limits are not enabled by default. They are either set too large to capture empty CONTINUATION frames attacks or too small to handle normal HTTP requests appropriately."
    },
    {
      "lang": "es",
      "value": "Los límites de velocidad de Tempesta FW no están habilitados de forma predeterminada. O están configurados demasiado grandes para capturar ataques de frames de CONTINUACIÓN vacíos o demasiado pequeños para manejar adecuadamente las solicitudes HTTP normales."
    }
  ],
  "lastModified": "2026-06-17T07:25:29.240",
  "sourceIdentifier": "cret@cert.org"
}