Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade nginx-mod-http-perlUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2Upgrade mod_http2-debuginfoUpgrade nghttp2-debuginfoUpgrade libnghttp2-develUpgrade mod_http2Upgrade nghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nginxUpgrade nodejsUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mailUpgrade libnghttp2-debuginfoUpgrade libnghttp2Upgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nghttp2-debugsourceUpgrade nodejs-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-debugsourceUpgrade nghttp2-debuginfoUpgrade nginx-debuginfoUpgrade nginx-all-modulesUpgrade nodejs-docsUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-perlUpgrade nodejs-nodemonUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginxUpgrade nghttp2Upgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade nodeUpgrade libnghttp2Upgrade nginx-develUpgrade node8Upgrade nghttp2Upgrade nginx | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-all-modules | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade nginx-filesystemUpgrade libnghttp2-develUpgrade libnghttp2Upgrade nodejs-docsUpgrade olcne-istio-chartUpgrade olcne-api-serverUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade olcne-prometheus-chartUpgrade nghttp2Upgrade nginxUpgrade nodejsUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade olcnectlUpgrade olcne-agentUpgrade nodejs-develUpgrade nginx-mod-http-perlUpgrade olcne-utilsUpgrade olcne-nginxUpgrade nginx-all-modules | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade nghttp2Upgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade libnghttp2-debuginfoUpgrade npmUpgrade nginxUpgrade nghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade nginx-all-modulesUpgrade nodejs-debuginfoUpgrade libnghttp2-develUpgrade nginx-mod-streamUpgrade nginx-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade libnghttp2Upgrade nodejs-docsUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-mail-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade python3-nghttp2Upgrade firefox-libcairo-gobject2Upgrade libfirefox-glib-2_0-0Upgrade nodejs12-develUpgrade firefox-libffi4Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs10-develUpgrade nodejs10Upgrade libnghttp2-14Upgrade mozilla-nss-certsUpgrade nodejs8Upgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade npm10Upgrade nodejs8-docsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade npm8Upgrade libnghttp2_asio-develUpgrade libfreebl3Upgrade nodejs8-develUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade nginxUpgrade firefox-libffi7Upgrade firefox-glib2-toolsUpgrade mozillafirefoxUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-certs-32bitUpgrade npm12Upgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gio-branding-upstreamUpgrade nodejs10-docsUpgrade firefox-atk-langUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libpango-1_0-0Upgrade firefox-libatk-1_0-0Upgrade nginx-sourceUpgrade libnghttp2_asio1-32bitUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade libsoftokn3Upgrade mozillafirefox-translations-otherUpgrade mozillafirefox-branding-sledUpgrade nghttp2Upgrade mozilla-nssUpgrade firefox-gtk3-langUpgrade firefox-glib2-langUpgrade firefox-libgtk-3-0Upgrade libfirefox-gthread-2_0-0Upgrade nodejs12-docsUpgrade vim-plugin-nginxUpgrade firefox-libharfbuzz0Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade libnghttp2-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs12Upgrade libnghttp2_asio1Upgrade mozillafirefox-translations-commonUpgrade firefox-libcairo2Upgrade libnghttp2-14-32bitUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-tools | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-coreUpgrade nghttp2-serverUpgrade nginx-lightUpgrade nginx-fullUpgrade libnghttp2-14Upgrade nginx-commonUpgrade nginx-extrasUpgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nghttp2-proxy (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub