Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginxUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nghttp2Upgrade nodejs | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2-develUpgrade nghttp2-debuginfoUpgrade nghttp2Upgrade mod_http2Upgrade mod_http2-debuginfoUpgrade libnghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade npmUpgrade nghttp2-debugsourceUpgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nodejs-debugsourceUpgrade nghttp2-debuginfoUpgrade nodejs-docsUpgrade nginx-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-streamUpgrade libnghttp2-debuginfoUpgrade nodejs-develUpgrade nginx-mod-mailUpgrade nodejsUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nodejs-devel-debuginfoUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2 | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nghttp2Upgrade nginxUpgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade node8Upgrade nginx-develUpgrade nghttp2Upgrade node10Upgrade libnghttp2Upgrade node | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modules | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade olcne-api-serverUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade olcne-istio-chartUpgrade nghttp2Upgrade nodejs-docsUpgrade libnghttp2-develUpgrade libnghttp2Upgrade nginx-mod-streamUpgrade olcne-prometheus-chartUpgrade olcne-utilsUpgrade nodejs-packagingUpgrade olcnectlUpgrade olcne-agentUpgrade nginx-all-modulesUpgrade olcne-nginxUpgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mail | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-all-modulesUpgrade npmUpgrade nodejs-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nghttp2Upgrade libnghttp2-develUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade nghttp2-debuginfoUpgrade nginx-filesystemUpgrade nghttp2-debugsourceUpgrade libnghttp2-debuginfoUpgrade nginxUpgrade nginx-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade libnghttp2Upgrade nodejs-nodemonUpgrade nodejs-devel-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nginx-mod-mail | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-libharfbuzz0Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-branding-SLEDUpgrade nghttp2Upgrade firefox-libcairo2Upgrade libnghttp2_asio1Upgrade libnghttp2-14-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-toolsUpgrade mozilla-nss-develUpgrade mozilla-nssUpgrade mozilla-nspr-32bitUpgrade firefox-glib2-langUpgrade nginx-sourceUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade libsoftokn3Upgrade libnghttp2-develUpgrade firefox-libatk-1_0-0Upgrade nodejs12Upgrade libnghttp2_asio1-32bitUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-langUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libgtk-3-0Upgrade MozillaFirefox-translations-otherUpgrade vim-plugin-nginxUpgrade nodejs12-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-certs-32bitUpgrade firefox-gdk-pixbuf-langUpgrade libnghttp2_asio-develUpgrade libnghttp2-14Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade nodejs10-docsUpgrade firefox-gio-branding-upstreamUpgrade firefox-atk-langUpgrade nginxUpgrade MozillaFirefoxUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade npm8Upgrade mozilla-nss-32bitUpgrade firefox-libffi7Upgrade python3-nghttp2Upgrade nodejs10-develUpgrade mozilla-nsprUpgrade libfreebl3-32bitUpgrade npm10Upgrade nodejs10Upgrade libfreebl3Upgrade mozilla-nss-certsUpgrade firefox-libffi4Upgrade libfirefox-gobject-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-libcairo-gobject2Upgrade libfirefox-glib-2_0-0Upgrade nodejs8-docsUpgrade npm12Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-gio-2_0-0Upgrade nodejs12-develUpgrade nodejs8-develUpgrade nodejs8 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade libnghttp2-14Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2Upgrade nghttp2-server (Ubuntu Pro)Upgrade nginx-commonUpgrade nginx-fullUpgrade nginx-extrasUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nginx-coreUpgrade nginx-lightUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-server | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub