Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nghttp2Upgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade libnghttp2Upgrade mod_http2Upgrade nghttp2Upgrade libnghttp2-develUpgrade nghttp2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-filesystemUpgrade nodejs-packagingUpgrade libnghttp2Upgrade nodejs-devel-debuginfoUpgrade nginx-mod-mailUpgrade nginxUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2-debuginfoUpgrade nodejsUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs-docsUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nginx-mod-http-perl-debuginfoUpgrade nghttp2-debugsourceUpgrade nginx-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade npmUpgrade nginx-mod-http-xslt-filter | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade libnghttp2Upgrade nodeUpgrade node10Upgrade nghttp2Upgrade nginxUpgrade nginx-develUpgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginxUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-stream | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade olcne-utilsUpgrade nginx-all-modulesUpgrade olcne-agentUpgrade olcne-nginxUpgrade nodejsUpgrade nginx-mod-http-perlUpgrade olcnectlUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nghttp2Upgrade olcne-prometheus-chartUpgrade libnghttp2Upgrade libnghttp2-develUpgrade nodejs-nodemonUpgrade nginx-mod-streamUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade olcne-istio-chartUpgrade nodejs-docsUpgrade olcne-api-server | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade libnghttp2Upgrade nodejs-debugsourceUpgrade nginx-debuginfoUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-all-modulesUpgrade libnghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade nghttp2-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nghttp2Upgrade nodejsUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade npmUpgrade libnghttp2-develUpgrade nginx-mod-mailUpgrade nodejs-packaging | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-streamUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filter | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade python3-nghttp2Upgrade firefox-atk-langUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-vietnameseUpgrade libnghttp2_asio-develUpgrade firefox-libffi7Upgrade npm10Upgrade nodejs8Upgrade firefox-gdk-pixbuf-query-loadersUpgrade nodejs12-develUpgrade libfirefox-glib-2_0-0Upgrade nodejs10-develUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-glib2-toolsUpgrade npm8Upgrade nodejs8-develUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs10Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libffi4Upgrade libfreebl3Upgrade libnghttp2-14Upgrade nodejs8-docsUpgrade firefox-gio-branding-upstreamUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade mozilla-nss-32bitUpgrade nodejs10-docsUpgrade npm12Upgrade nginxUpgrade mozilla-nss-certs-32bitUpgrade mozilla-nss-certsUpgrade firefox-libcairo-gobject2Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade libnghttp2_asio1Upgrade nghttp2Upgrade mozillafirefox-translations-otherUpgrade firefox-gtk3-langUpgrade firefox-glib2-langUpgrade libsoftokn3Upgrade firefox-gtk3-immodules-tigrignaUpgrade nginx-sourceUpgrade libnghttp2_asio1-32bitUpgrade firefox-libatk-1_0-0Upgrade libnghttp2-develUpgrade nodejs12Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libcairo2Upgrade firefox-libharfbuzz0Upgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-dataUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-toolsUpgrade libnghttp2-14-32bitUpgrade mozilla-nspr-32bitUpgrade mozilla-nssUpgrade mozilla-nss-develUpgrade mozillafirefox-branding-sledUpgrade nodejs12-docsUpgrade firefox-gtk3-immodule-ximUpgrade vim-plugin-nginxUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libgtk-3-0 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-lightUpgrade nginx-coreUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-serverUpgrade libnghttp2-14Upgrade nghttp2Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2-server (Ubuntu Pro)Upgrade nginx-fullUpgrade nginx-extrasUpgrade nghttp2-proxyUpgrade nginx-common | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub