Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade py3-twistedUpgrade h2oUpgrade nodejsUpgrade containerd | Aug 22, 2024 | Aug 13, 2019 |
| Arista Eos | — | Upgrade to a remediated version or install provided hotfix | Sep 4, 2024 | Nov 6, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-devel | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade trafficserverUpgrade h2o | Oct 23, 2019 | Aug 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 20, 2019 |
| Freebsd | — | Upgrade py38-twistedUpgrade node10Upgrade h2oUpgrade h2o-develUpgrade py27-twistedUpgrade node8Upgrade py35-twistedUpgrade py36-twistedUpgrade nodeUpgrade py37-twisted | Apr 21, 2020 | Aug 25, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade npmUpgrade nodejs-devel | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat Openshift | — | Upgrade sriov-network-device-plugin | Oct 8, 2019 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade npm | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-libpango-1_0-0Upgrade mozilla-nss-toolsUpgrade nodejs10-develUpgrade firefox-libgtk-3-0Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nss-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs10Upgrade firefox-libcairo2Upgrade firefox-libatk-1_0-0Upgrade firefox-libffi4Upgrade firefox-gtk3-langUpgrade libsoftokn3Upgrade libfirefox-gio-2_0-0Upgrade npm10Upgrade npm8Upgrade firefox-gtk3-toolsUpgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-certs-32bitUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade libfirefox-glib-2_0-0Upgrade firefox-libharfbuzz0Upgrade mozilla-nspr-32bitUpgrade firefox-glib2-langUpgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3-32bitUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade nodejs8-develUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gthread-2_0-0Upgrade python3-twistedUpgrade nodejs8-docsUpgrade firefox-libffi7Upgrade npm12Upgrade MozillaFirefoxUpgrade nodejs12Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs10-docsUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-dataUpgrade nodejs12-docsUpgrade mozilla-nss-develUpgrade nodejs12-develUpgrade libsoftokn3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nspr-develUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-atk-langUpgrade MozillaFirefox-translations-commonUpgrade libfreebl3Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gio-branding-upstreamUpgrade nodejs8 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade python3-twistedUpgrade libnetty-java (Ubuntu Pro)Upgrade python-twisted-binUpgrade python3-twisted-binUpgrade python-twistedUpgrade python-twisted-web | Mar 20, 2020 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub