Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-http-perlUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade mod_http2Upgrade libnghttp2-develUpgrade nghttp2Upgrade libnghttp2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nodejs-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nodejs-docsUpgrade nghttp2-debugsourceUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade libnghttp2Upgrade nginxUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejsUpgrade nodejs-develUpgrade libnghttp2-debuginfoUpgrade nodejs-packagingUpgrade nginx-filesystem | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade nghttp2Upgrade nginx-develUpgrade nginxUpgrade nodeUpgrade node10Upgrade libnghttp2 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystem | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade olcne-utilsUpgrade nodejs-develUpgrade nginx-mod-mailUpgrade nginxUpgrade olcne-nginxUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade olcne-agentUpgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade olcnectlUpgrade nginx-filesystemUpgrade olcne-api-serverUpgrade nghttp2Upgrade nodejs-nodemonUpgrade olcne-prometheus-chartUpgrade libnghttp2Upgrade nginx-mod-http-xslt-filterUpgrade libnghttp2-develUpgrade nodejs-docsUpgrade olcne-istio-chartUpgrade npmUpgrade nginx-mod-stream | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade libnghttp2Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-debuginfoUpgrade libnghttp2-develUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade npmUpgrade nginx-filesystemUpgrade nghttp2Upgrade libnghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nodejs-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-all-modules | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-stream | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs8-docsUpgrade npm12Upgrade nodejs10Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs10-develUpgrade libfreebl3Upgrade libnghttp2-14Upgrade firefox-libffi4Upgrade firefox-libcairo-gobject2Upgrade python3-nghttp2Upgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs12-develUpgrade libfreebl3-32bitUpgrade MozillaFirefoxUpgrade libnghttp2_asio-develUpgrade npm8Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-certsUpgrade nginxUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-atk-langUpgrade mozilla-nss-certs-32bitUpgrade nodejs8-develUpgrade firefox-libffi7Upgrade npm10Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nsprUpgrade libfirefox-gobject-2_0-0Upgrade nodejs8Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-32bitUpgrade libnghttp2-14-32bitUpgrade libsoftokn3Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade mozilla-nss-develUpgrade firefox-libatk-1_0-0Upgrade mozilla-nssUpgrade firefox-gtk3-immodules-tigrignaUpgrade MozillaFirefox-branding-SLEDUpgrade MozillaFirefox-translations-otherUpgrade nghttp2Upgrade firefox-gtk3-toolsUpgrade mozilla-nspr-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade libnghttp2_asio1-32bitUpgrade firefox-gtk3-langUpgrade firefox-glib2-langUpgrade mozilla-nss-toolsUpgrade nginx-sourceUpgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-multipressUpgrade libnghttp2_asio1Upgrade firefox-libharfbuzz0Upgrade nodejs12-docsUpgrade vim-plugin-nginxUpgrade firefox-libgtk-3-0Upgrade libnghttp2-develUpgrade libfirefox-gthread-2_0-0Upgrade nodejs12Upgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nspr-32bit | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-serverUpgrade nginx-coreUpgrade nginx-lightUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nghttp2-server (Ubuntu Pro)Upgrade libnghttp2-14Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2Upgrade nginx-commonUpgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nginx-fullUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade nginx-extras | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub