Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginxUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade libnghttp2Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2-develUpgrade mod_http2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade libnghttp2-debuginfoUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-develUpgrade libnghttp2Upgrade nodejs-docsUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nginx-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nghttp2-debugsourceUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nginx-debugsourceUpgrade nginx-mod-http-perlUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nghttp2Upgrade nginxUpgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade nginx-develUpgrade nghttp2Upgrade nginxUpgrade nodeUpgrade libnghttp2Upgrade node10 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginxUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nodejsUpgrade olcne-agentUpgrade olcne-nginxUpgrade olcnectlUpgrade nodejs-packagingUpgrade olcne-utilsUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nodejs-develUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade olcne-istio-chartUpgrade nodejs-nodemonUpgrade nginx-filesystemUpgrade olcne-prometheus-chartUpgrade nghttp2Upgrade olcne-api-serverUpgrade nodejs-docsUpgrade libnghttp2-develUpgrade libnghttp2Upgrade npmUpgrade nginx-mod-http-xslt-filter | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade libnghttp2Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade npmUpgrade nodejsUpgrade nghttp2-debugsourceUpgrade libnghttp2-develUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-all-modulesUpgrade nodejs-debuginfoUpgrade nginx-filesystemUpgrade libnghttp2-debuginfoUpgrade nodejs-packagingUpgrade nghttp2Upgrade nginx-mod-mail-debuginfoUpgrade nginxUpgrade nghttp2-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs12-docsUpgrade libsoftokn3-32bitUpgrade libfirefox-gthread-2_0-0Upgrade libnghttp2_asio1Upgrade firefox-gtk3-dataUpgrade vim-plugin-nginxUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodules-tigrignaUpgrade libnghttp2-14-32bitUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-translations-otherUpgrade firefox-libharfbuzz0Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-langUpgrade libsoftokn3Upgrade nginx-sourceUpgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefox-translations-commonUpgrade nghttp2Upgrade libnghttp2_asio1-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nspr-develUpgrade libnghttp2-develUpgrade mozilla-nssUpgrade mozilla-nss-toolsUpgrade nodejs12Upgrade firefox-glib2-langUpgrade mozilla-nss-develUpgrade firefox-gtk3-toolsUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-libcairo2Upgrade firefox-libffi7Upgrade mozilla-nss-certsUpgrade libnghttp2_asio-develUpgrade libfreebl3-32bitUpgrade npm10Upgrade nodejs12-develUpgrade firefox-atk-langUpgrade firefox-libpango-1_0-0Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfreebl3Upgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade libnghttp2-14Upgrade nodejs10Upgrade firefox-libffi4Upgrade firefox-libcairo-gobject2Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade npm12Upgrade nodejs10-develUpgrade nodejs8Upgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-query-loadersUpgrade python3-nghttp2Upgrade nginxUpgrade nodejs8-docsUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade npm8Upgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefoxUpgrade firefox-glib2-toolsUpgrade nodejs8-devel | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-coreUpgrade nghttp2-serverUpgrade nginx-lightUpgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2-proxyUpgrade nginx-extrasUpgrade libnghttp2-14Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nginx-fullUpgrade nghttp2Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nginx-commonUpgrade nghttp2 (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub