Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nghttp2Upgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade libnghttp2Upgrade libnghttp2-develUpgrade nghttp2Upgrade mod_http2Upgrade nghttp2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nodejs-nodemonUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-docsUpgrade npmUpgrade nginx-all-modulesUpgrade nghttp2-debugsourceUpgrade nghttp2-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2Upgrade nginxUpgrade libnghttp2-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade node8Upgrade nghttp2Upgrade nginx-develUpgrade libnghttp2Upgrade nodeUpgrade node10 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-filesystem | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade olcne-utilsUpgrade olcne-agentUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nodejsUpgrade nodejs-packagingUpgrade olcnectlUpgrade nodejs-develUpgrade nginx-mod-mailUpgrade olcne-nginxUpgrade nghttp2Upgrade olcne-api-serverUpgrade nginx-filesystemUpgrade npmUpgrade olcne-prometheus-chartUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade olcne-istio-chartUpgrade libnghttp2-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade libnghttp2 | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-develUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-nodemonUpgrade nginx-debugsourceUpgrade nodejs-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nodejs-docsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade libnghttp2Upgrade nginx-debuginfoUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nodejsUpgrade npmUpgrade nodejs-debuginfoUpgrade nginx-all-modulesUpgrade libnghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade nghttp2Upgrade nginxUpgrade nghttp2-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade libnghttp2-devel | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-stream | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade libfirefox-glib-2_0-0Upgrade npm10Upgrade firefox-libffi4Upgrade libfreebl3Upgrade nodejs12-develUpgrade nodejs8-develUpgrade libnghttp2_asio-develUpgrade nginxUpgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3-32bitUpgrade nodejs10Upgrade mozilla-nss-certsUpgrade mozilla-nss-32bitUpgrade libnghttp2-14Upgrade nodejs8Upgrade mozillafirefoxUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-glib2-toolsUpgrade npm8Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libcairo-gobject2Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nsprUpgrade npm12Upgrade nodejs10-develUpgrade nodejs8-docsUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gobject-2_0-0Upgrade firefox-atk-langUpgrade firefox-libpango-1_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs10-docsUpgrade mozilla-nss-certs-32bitUpgrade firefox-libffi7Upgrade python3-nghttp2Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs12-docsUpgrade mozillafirefox-translations-commonUpgrade libsoftokn3-32bitUpgrade libnghttp2_asio1Upgrade firefox-gtk3-immodules-tigrignaUpgrade libfirefox-gthread-2_0-0Upgrade vim-plugin-nginxUpgrade firefox-libgtk-3-0Upgrade firefox-libcairo2Upgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade libnghttp2-develUpgrade nodejs12Upgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-dataUpgrade libnghttp2-14-32bitUpgrade nginx-sourceUpgrade firefox-glib2-langUpgrade nghttp2Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-langUpgrade libsoftokn3Upgrade mozillafirefox-translations-otherUpgrade libnghttp2_asio1-32bitUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade mozilla-nssUpgrade mozilla-nspr-32bitUpgrade mozillafirefox-branding-sledUpgrade firefox-libgdk_pixbuf-2_0-0 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2Upgrade libnghttp2-14Upgrade nghttp2-server (Ubuntu Pro)Upgrade nginx-commonUpgrade nginx-fullUpgrade nginx-extrasUpgrade nghttp2-proxyUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-serverUpgrade nginx-coreUpgrade nginx-lightUpgrade nghttp2-client (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub