Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade libnghttp2-develUpgrade nghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginxUpgrade npmUpgrade nginx-mod-mailUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-develUpgrade nginx-mod-stream-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-all-modulesUpgrade nodejs-debuginfoUpgrade libnghttp2Upgrade nodejs-nodemonUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nodejs-debugsourceUpgrade nginx-filesystemUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-streamUpgrade nghttp2-debugsourceUpgrade nodejs-packaging | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade libnghttp2Upgrade node10Upgrade nodeUpgrade nginxUpgrade nghttp2Upgrade nginx-devel | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-mail | Sep 30, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade libnghttp2Upgrade nginx-mod-streamUpgrade nginxUpgrade nghttp2Upgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-filesystemUpgrade libnghttp2-develUpgrade nginx-mod-mailUpgrade npm | Jul 21, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginxUpgrade nghttp2-debugsourceUpgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nghttp2Upgrade nodejs-debuginfoUpgrade nginx-debugsourceUpgrade nginx-filesystemUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nodejs-develUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-devel-debuginfoUpgrade libnghttp2-develUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade libnghttp2Upgrade nginx-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs-docs | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debuginfoUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perl | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-langUpgrade firefox-libpango-1_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade nodejs8Upgrade nodejs10Upgrade nodejs12-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-glib2-toolsUpgrade nodejs12-docsUpgrade nodejs12Upgrade firefox-libatk-1_0-0Upgrade libfreebl3-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade mozilla-nss-toolsUpgrade mozilla-nss-develUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-certs-32bitUpgrade nodejs8-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libcairo2Upgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade nodejs10-docsUpgrade libsoftokn3Upgrade nodejs8-develUpgrade firefox-glib2-langUpgrade libnghttp2_asio1-32bitUpgrade nodejs10-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libnghttp2_asio1Upgrade MozillaFirefox-branding-SLEDUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade libnghttp2-14Upgrade libnghttp2-14-32bitUpgrade firefox-libffi4Upgrade libfirefox-glib-2_0-0Upgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefox-translations-commonUpgrade firefox-atk-langUpgrade npm8Upgrade python3-nghttp2Upgrade npm10Upgrade nginxUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade libnghttp2_asio-develUpgrade nghttp2Upgrade firefox-libcairo-gobject2Upgrade mozilla-nspr-develUpgrade mozilla-nssUpgrade firefox-gdk-pixbuf-langUpgrade mozilla-nsprUpgrade vim-plugin-nginxUpgrade npm12Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade libnghttp2-develUpgrade libfreebl3Upgrade nginx-source | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-server (Ubuntu Pro)Upgrade nginx-extrasUpgrade libnghttp2-14Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-lightUpgrade nghttp2Upgrade nginx-commonUpgrade nginx-coreUpgrade nghttp2-clientUpgrade nginx-fullUpgrade nghttp2-serverUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nghttp2-proxy (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub