A CONTINUATION frame is an HTTP/2 frame used to continue transmitting header fields after the initial HEADERS frame. It is normal protocol behavior, but implementations must handle it safely. If the sequence is not constrained, an attacker can use it to drive excessive parsing and memory consumption.
Expanded Definition
A CONTINUATION frame is part of the HTTP/2 header-compression and framing model. It exists to carry additional header block fragments after an initial HEADERS frame when the header section does not fit into a single frame. That makes it a protocol-structure term, not a separate security feature, and its meaning is tied to how HTTP/2 reassembles header blocks across multiple frames.
The boundary that matters most is simple: CONTINUATION frames are normal when they complete a header block, but they become problematic when an implementation accepts long or unconstrained sequences without enforcing practical limits. The protocol-level concern is not the frame itself; it is the parsing work, buffering, and state tracking required to process it correctly. That distinction is important because some discussions treat CONTINUATION frames as an attack in themselves, when the real issue is excessive header expansion or resource consumption caused by unsafe handling. The OWASP Non-Human Identity Top 10 is not directly relevant here, because the term is about HTTP/2 framing rather than machine identity governance.
Examples and Use Cases
In normal HTTP/2 traffic, large request or response header sets may be split across a HEADERS frame followed by one or more CONTINUATION frames until the header block is complete.
- A reverse proxy receives an authenticated request with many cookies and request headers, then reassembles them from multiple frames before forwarding.
- A web application gateway parses header blocks incrementally so it can maintain protocol compliance while enforcing size and count limits.
- A load balancer streams large response headers from an upstream service, using CONTINUATION frames to preserve framing rules without truncation.
- An HTTP/2 test harness deliberately generates fragmented headers to verify that the parser rejects malformed sequences and oversized header blocks.
The practical tradeoff is between protocol flexibility and resource control: allowing fragmentation improves compatibility with large headers, but it also increases the amount of parsing state an implementation must hold until the block ends. If the parser tolerates unusually long chains, the cost shifts from transport handling into CPU and memory pressure.
Security Implications
The main security concern is resource exhaustion. A CONTINUATION sequence can force repeated parsing, state retention, and header reconstruction before the server can decide whether a request is acceptable. That can create disproportionate work relative to the size of the attacker’s traffic.
When implementations fail to bound header block length, frame count, or parse depth, several failure modes appear: elevated CPU usage, memory growth from buffered header fragments, delayed request handling, and reduced capacity for legitimate traffic. In edge components such as proxies, gateways, and load balancers, the blast radius can extend beyond one application because the shared parser or connection pool becomes the bottleneck. A common practitioner observation is that the weakness often sits in the protocol layer, not in application code, so teams may miss it when they only review business logic.
This is especially important where HTTP/2 is terminated centrally, because one overloaded parser can affect many downstream services even if those services are individually healthy.
Domain and Governance Relevance
CONTINUATION frames matter in HTTP/2 protocol governance because they sit at the boundary between spec compliance and safe operational limits. The term is relevant to secure protocol handling, parser hardening, and edge-service resilience rather than to identity governance in the strict sense.
The most important governance decision is whether the organisation treats framing limits as part of its protected network control surface. That includes setting documented header-size thresholds, deciding where HTTP/2 is terminated, and ensuring that parser behaviour is consistent across proxies and origin services. Because malformed or extreme frame sequences can be used to stress shared infrastructure, ownership usually belongs with platform and application delivery teams rather than with application developers alone.
For practitioners, the key insight is that safe handling of CONTINUATION frames is not about rejecting the protocol feature; it is about enforcing predictable resource boundaries so that normal fragmentation does not become an availability problem.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PT-1 — Protective Technology | HTTP/2 frame handling is a protective technology boundary needing safe parser limits. |
| Recommendation — Enforce protective parser controls to bound HTTP/2 header processing and preserve service availability. | ||
| CIS Controls v8 | 16 — Application Software Security | Framing and parsing logic are application-facing attack surfaces that need secure handling. |
| Recommendation — Secure HTTP/2 parsers and validate malformed frame sequences before they reach business logic. | ||
| MITRE ATT&CK | T1499 — Endpoint Denial of Service | Unbounded CONTINUATION sequences can drive denial-of-service through resource exhaustion. |
| Recommendation — Detect resource-exhaustion patterns and tune alerts for HTTP/2-based denial-of-service attempts. | ||
Related resources from NHI Mgmt Group
- Who is accountable when an LLM follows an attacker’s frame and causes harm?
- Why do first- and last-frame controls matter for commercial AI video?
- How do GDPR and CPRA differ in how they frame data minimization and retention?
- How should security teams frame application security decisions in business risk terms?
