Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nghttp2Upgrade nodejs | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2Upgrade nghttp2-debuginfoUpgrade mod_http2Upgrade libnghttp2-develUpgrade mod_http2-debuginfoUpgrade libnghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-mailUpgrade nodejs-devel-debuginfoUpgrade libnghttp2Upgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nodejs-develUpgrade nodejsUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginxUpgrade nodejs-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nghttp2-debugsourceUpgrade nodejs-docsUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-debugsourceUpgrade nodejs-nodemonUpgrade npm | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginxUpgrade nghttp2Upgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade libnghttp2Upgrade nodeUpgrade nginxUpgrade node8Upgrade nghttp2Upgrade nginx-devel | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade olcne-nginxUpgrade nginx-all-modulesUpgrade olcnectlUpgrade olcne-utilsUpgrade nodejs-develUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade olcne-agentUpgrade nodejsUpgrade nodejs-packagingUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade olcne-istio-chartUpgrade libnghttp2-develUpgrade nghttp2Upgrade nodejs-docsUpgrade olcne-prometheus-chartUpgrade nginx-mod-streamUpgrade libnghttp2Upgrade olcne-api-serverUpgrade npm | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginx-all-modulesUpgrade nginxUpgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade libnghttp2-debuginfoUpgrade nghttp2-debuginfoUpgrade npmUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejsUpgrade nginx-filesystemUpgrade nghttp2-debugsourceUpgrade libnghttp2-develUpgrade nghttp2Upgrade nodejs-docsUpgrade libnghttp2Upgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nginx-debugsourceUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filterUpgrade nodejs-devel | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade python3-nghttp2Upgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nsprUpgrade nodejs10-develUpgrade mozilla-nss-32bitUpgrade nodejs10Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi4Upgrade libnghttp2-14Upgrade firefox-libcairo-gobject2Upgrade nodejs12-develUpgrade npm10Upgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade npm12Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libnghttp2_asio-develUpgrade firefox-libffi7Upgrade firefox-gdk-pixbuf-langUpgrade nodejs8-docsUpgrade nodejs8Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-certsUpgrade nginxUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-atk-langUpgrade firefox-gio-branding-upstreamUpgrade nodejs8-develUpgrade firefox-libpango-1_0-0Upgrade libfreebl3Upgrade firefox-glib2-toolsUpgrade npm8Upgrade libfirefox-gio-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade nginx-sourceUpgrade libnghttp2_asio1Upgrade firefox-gtk3-toolsUpgrade firefox-libcairo2Upgrade firefox-gtk3-dataUpgrade libnghttp2-14-32bitUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-langUpgrade nodejs12-docsUpgrade libnghttp2_asio1-32bitUpgrade vim-plugin-nginxUpgrade libfirefox-gthread-2_0-0Upgrade mozillafirefox-translations-otherUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefox-branding-sledUpgrade mozillafirefox-translations-commonUpgrade firefox-libatk-1_0-0Upgrade libsoftokn3Upgrade mozilla-nss-develUpgrade nghttp2Upgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nssUpgrade firefox-glib2-langUpgrade libsoftokn3-32bitUpgrade mozilla-nspr-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs12Upgrade mozilla-nss-toolsUpgrade libnghttp2-develUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libharfbuzz0 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-serverUpgrade nginx-coreUpgrade nginx-lightUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nginx-commonUpgrade nghttp2-proxyUpgrade nginx-fullUpgrade nginx-extrasUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2Upgrade nghttp2-clientUpgrade nghttp2 (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub