Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-filesystemUpgrade nginxUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modules | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nodejs | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-develUpgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nodejs-docsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nodejs-nodemonUpgrade npmUpgrade nginx-mod-mailUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-filesystemUpgrade nginx-debuginfoUpgrade nodejs-packagingUpgrade nginx-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade node10Upgrade nodeUpgrade node8Upgrade nginx-devel | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginxUpgrade nodejsUpgrade nginx-mod-mailUpgrade nodejs-docsUpgrade nodejs-develUpgrade nginx-all-modulesUpgrade npmUpgrade nodejs-nodemonUpgrade nginx-filesystem | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nginx-debugsourceUpgrade nginx-all-modulesUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade nginx-mod-http-image-filterUpgrade nginx-debuginfoUpgrade nodejs-packagingUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-docsUpgrade nginx-filesystemUpgrade nodejs-devel-debuginfoUpgrade nginxUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfo | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade vim-plugin-nginxUpgrade nginxUpgrade mozilla-nspr-32bitUpgrade mozilla-nspr-develUpgrade MozillaFirefox-translations-commonUpgrade npm10Upgrade mozilla-nssUpgrade firefox-libgtk-3-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade npm8Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-libffi4Upgrade mozilla-nsprUpgrade firefox-libharfbuzz0Upgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-libcairo-gobject2Upgrade firefox-libcairo2Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-toolsUpgrade nginx-sourceUpgrade firefox-atk-langUpgrade firefox-libffi7Upgrade libfreebl3Upgrade nodejs8Upgrade mozilla-nss-develUpgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade firefox-libatk-1_0-0Upgrade npm12Upgrade nodejs8-develUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-certsUpgrade libsoftokn3Upgrade MozillaFirefox-translations-otherUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs10-docsUpgrade mozilla-nss-certs-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-vietnameseUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade libfreebl3-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nss-toolsUpgrade nodejs10Upgrade nodejs12-develUpgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs10-develUpgrade nodejs12-docsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-langUpgrade nodejs12Upgrade MozillaFirefoxUpgrade nodejs8-docs | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-extrasUpgrade nginx-commonUpgrade nginx-fullUpgrade nginx-lightUpgrade nginx-core | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub