Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nodejs-nodemonUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-all-modules | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2-develUpgrade nghttp2Upgrade nghttp2-debuginfoUpgrade mod_http2Upgrade libnghttp2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejsUpgrade libnghttp2Upgrade libnghttp2-debuginfoUpgrade nginxUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nodejs-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-nodemonUpgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-mod-http-perlUpgrade nghttp2-debugsourceUpgrade nodejs-docs | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nghttp2Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nghttp2Upgrade node8Upgrade nginxUpgrade nginx-develUpgrade node10Upgrade libnghttp2Upgrade node | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-stream | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-filesystemUpgrade libnghttp2Upgrade olcne-prometheus-chartUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade libnghttp2-develUpgrade olcne-istio-chartUpgrade nginx-mod-streamUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade olcne-api-serverUpgrade nghttp2Upgrade olcne-utilsUpgrade olcne-agentUpgrade olcnectlUpgrade nodejs-packagingUpgrade nginx-all-modulesUpgrade nginxUpgrade nodejs-develUpgrade nginx-mod-http-perlUpgrade olcne-nginxUpgrade nodejsUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filter | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade npmUpgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-all-modulesUpgrade nghttp2-debugsourceUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade libnghttp2-develUpgrade nginxUpgrade nghttp2Upgrade nghttp2-debuginfoUpgrade nodejs-packagingUpgrade nodejsUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filterUpgrade libnghttp2Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-docsUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade nodejs-nodemon | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mail | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs8-docsUpgrade nodejs8Upgrade npm12Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfreebl3Upgrade libnghttp2-14Upgrade nodejs10Upgrade firefox-libcairo-gobject2Upgrade nodejs12-develUpgrade mozilla-nss-32bitUpgrade npm8Upgrade firefox-libffi4Upgrade npm10Upgrade libfreebl3-32bitUpgrade mozilla-nss-certsUpgrade libfirefox-glib-2_0-0Upgrade nodejs10-docsUpgrade libnghttp2_asio-develUpgrade libfirefox-gobject-2_0-0Upgrade python3-nghttp2Upgrade firefox-libffi7Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gio-branding-upstreamUpgrade nginxUpgrade libfirefox-gio-2_0-0Upgrade nodejs8-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-certs-32bitUpgrade MozillaFirefoxUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libpango-1_0-0Upgrade mozilla-nsprUpgrade nodejs10-develUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-atk-langUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade libnghttp2-14-32bitUpgrade firefox-libgtk-3-0Upgrade nodejs12-docsUpgrade firefox-libcairo2Upgrade libfirefox-gthread-2_0-0Upgrade libnghttp2_asio1Upgrade vim-plugin-nginxUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-ximUpgrade libnghttp2-develUpgrade MozillaFirefox-translations-commonUpgrade nodejs12Upgrade firefox-gtk3-langUpgrade nginx-sourceUpgrade firefox-glib2-langUpgrade libnghttp2_asio1-32bitUpgrade firefox-libatk-1_0-0Upgrade nghttp2Upgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nspr-develUpgrade libsoftokn3Upgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-toolsUpgrade mozilla-nssUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-multipress | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-coreUpgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-lightUpgrade nghttp2-serverUpgrade nginx-extrasUpgrade nghttp2-clientUpgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nginx-fullUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nghttp2-proxyUpgrade nghttp2Upgrade nginx-common | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub