CVE-2024-39702: OpenResty Hash Denial of Service Flaw

CVE-2024-39702 Overview

CVE-2024-39702 is a Hash Denial of Service (HashDoS) vulnerability in the lj_str_hash.c string hashing function used during string interning in OpenResty. The flaw affects OpenResty versions 1.19.3.1 through 1.25.3.1 and is scoped to the OpenResty fork of LuaJIT hosted in the openresty/luajit2 repository. The upstream LuaJIT/LuaJIT repository is not affected. An attacker who submits crafted requests can trigger excessive CPU consumption during proxy operations, exhausting resources with a low request volume. The weakness is classified under CWE-407: Inefficient Algorithmic Complexity.

Critical Impact

Remote unauthenticated attackers can degrade or disable OpenResty proxy instances by exploiting predictable string hashing to force worst-case hash table behavior.

Affected Products

• OpenResty 1.19.3.1 through 1.25.3.1
• OpenResty fork openresty/luajit2
• Deployments using OpenResty as a reverse proxy or API gateway

Discovery Timeline

• 2024-07-23 - CVE-2024-39702 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39702

Vulnerability Analysis

The vulnerability resides in lj_str_hash.c, the string hashing routine invoked when LuaJIT2 interns strings. String interning stores each unique string once in a global hash table so that later comparisons can be performed by pointer equality. When the hash function is weak or predictable, an attacker can craft many distinct input strings that all collide to the same hash bucket. Each new insertion then requires a linear walk of the collision chain, transforming an expected O(1) operation into O(n).

OpenResty routes request data, header names, URI components, and query parameters through Lua handlers that repeatedly intern strings. A proxy processing crafted requests spends disproportionate CPU cycles resolving collisions, starving legitimate traffic. See the OpenResty Security Announcement for vendor details.

Root Cause

The root cause is inefficient algorithmic complexity in the string hash function. The hash lacks sufficient randomization or a keyed construction, so an attacker who understands the algorithm can precompute inputs that map to identical hash values, defeating the amortized performance guarantees of the interning hash table.

Attack Vector

The attack is remote and unauthenticated. An attacker sends HTTP requests containing headers, cookies, URI paths, or bodies populated with many colliding strings. Each request forces the OpenResty worker to insert those strings into the intern table, consuming CPU. Sustained low-rate traffic can exhaust worker capacity and produce a denial of service.

The vulnerability is described in prose because no verified public exploit code is available. Attack complexity is elevated because the adversary must generate strings tuned to the specific hash function used in openresty/luajit2.

Detection Methods for CVE-2024-39702

Indicators of Compromise

• Sustained high CPU utilization on OpenResty worker processes without a matching increase in request volume
• Increased request latency and timeouts on endpoints that parse many string tokens (headers, query strings, JSON bodies)
• Nginx error logs showing worker slowdowns, upstream timeouts, or dropped connections during low-traffic periods

Detection Strategies

• Baseline CPU-per-request for OpenResty workers and alert on deviations that indicate algorithmic amplification
• Inspect access logs for anomalously large header sets, oversized query strings, or repeated distinct tokens sharing structural patterns
• Correlate nginx -T worker metrics with connection-level latency to identify workers stuck in hash operations

Monitoring Recommendations

• Enable request-body and header-size logging with limits enforced at the nginx layer
• Ship OpenResty metrics and access logs to a centralized analytics platform for anomaly detection
• Track upstream p99 latency and worker CPU as leading indicators of algorithmic complexity attacks

How to Mitigate CVE-2024-39702

Immediate Actions Required

• Upgrade OpenResty to version 1.25.3.2 or later, which ships the patched luajit2 string hash implementation
• Inventory all OpenResty deployments, including containerized gateways and API proxies, to confirm affected versions
• Rate-limit and size-limit inbound HTTP headers, URIs, and bodies at the edge to reduce attack surface

Patch Information

OpenResty released a fix that hardens the string hashing function in the openresty/luajit2 repository. Users should install the version referenced in the OpenResty Security Announcement and restart all worker processes to load the patched runtime.

Workarounds

• Enforce strict large_client_header_buffers, client_header_buffer_size, and client_max_body_size limits in nginx.conf
• Deploy a Web Application Firewall (WAF) rule set to reject requests with abnormally large header counts or repeated collision-shaped tokens
• Apply per-IP connection and request rate limits using limit_req and limit_conn directives until patching is complete

# Configuration example: constrain header and body sizes in nginx.conf
http {
    client_header_buffer_size     1k;
    large_client_header_buffers   4 8k;
    client_max_body_size          1m;
    client_body_buffer_size       16k;

    limit_req_zone  $binary_remote_addr zone=req_zone:10m rate=20r/s;
    limit_conn_zone $binary_remote_addr zone=conn_zone:10m;

    server {
        listen 443 ssl;
        limit_req  zone=req_zone  burst=40 nodelay;
        limit_conn conn_zone 20;
    }
}