Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-packaging | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-devel-debuginfoUpgrade npmUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejs-devel | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade trafficserver | Oct 23, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade node10Upgrade node | Aug 21, 2019 | Aug 21, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508) | Aug 13, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemon | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-devel-debuginfo | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade mozilla-nsprUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nspr-32bitUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefox-translations-commonUpgrade firefox-glib2-langUpgrade nodejs10-develUpgrade libfirefox-gmodule-2_0-0Upgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nspr-develUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-branding-upstreamUpgrade libfreebl3Upgrade libfirefox-gthread-2_0-0Upgrade nodejs12-docsUpgrade firefox-libgtk-3-0Upgrade nodejs10-docsUpgrade firefox-libharfbuzz0Upgrade libsoftokn3Upgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3-32bitUpgrade mozilla-nss-develUpgrade firefox-gtk3-dataUpgrade npm12Upgrade mozilla-nss-certsUpgrade libfirefox-gobject-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libcairo-gobject2Upgrade firefox-gio-branding-upstreamUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodule-amharicUpgrade nodejs8-develUpgrade nodejs12-develUpgrade firefox-glib2-toolsUpgrade nodejs12Upgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3-32bitUpgrade firefox-gtk3-toolsUpgrade nodejs8Upgrade npm10Upgrade mozilla-nss-32bitUpgrade firefox-libffi7Upgrade firefox-gdk-pixbuf-langUpgrade firefox-atk-langUpgrade firefox-libffi4Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nssUpgrade firefox-libatk-1_0-0Upgrade firefox-libcairo2Upgrade nodejs8-docsUpgrade npm8Upgrade nodejs10Upgrade firefox-libpango-1_0-0 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade libnetty-java (Ubuntu Pro) | Mar 22, 2023 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub