Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2-develUpgrade mod_http2-debuginfoUpgrade libnghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-packagingUpgrade nodejs-devel-debuginfoUpgrade nginx-filesystemUpgrade libnghttp2Upgrade nginxUpgrade libnghttp2-debuginfoUpgrade nodejsUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nginx-mod-mailUpgrade nodejs-docsUpgrade nginx-mod-http-perlUpgrade nodejs-nodemonUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade npmUpgrade nginx-debuginfoUpgrade nodejs-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade nginx-develUpgrade node8Upgrade nghttp2Upgrade libnghttp2Upgrade nodeUpgrade node10 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-mail | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade olcne-prometheus-chartUpgrade npmUpgrade nghttp2Upgrade nginx-mod-http-xslt-filterUpgrade libnghttp2-develUpgrade nodejs-docsUpgrade olcne-istio-chartUpgrade libnghttp2Upgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade olcne-api-serverUpgrade nginx-mod-streamUpgrade olcne-utilsUpgrade olcne-agentUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade olcne-nginxUpgrade nodejs-packagingUpgrade olcnectlUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nodejs-develUpgrade nodejs | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nghttp2-debuginfoUpgrade nginxUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-debuginfoUpgrade libnghttp2-develUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nghttp2-debugsourceUpgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade npmUpgrade libnghttp2-debuginfoUpgrade nghttp2Upgrade nginx-filesystemUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nodejs-docsUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade libnghttp2Upgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-devel | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade libfreebl3-32bitUpgrade mozilla-nss-certsUpgrade nodejs10-develUpgrade nodejs8Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nsprUpgrade nodejs10-docsUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-atk-langUpgrade npm8Upgrade mozilla-nss-32bitUpgrade firefox-libffi7Upgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade MozillaFirefoxUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfreebl3Upgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-certs-32bitUpgrade npm12Upgrade npm10Upgrade libnghttp2-14Upgrade nginxUpgrade firefox-libffi4Upgrade nodejs8-develUpgrade libfirefox-gio-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade nodejs10Upgrade nodejs12-develUpgrade libfirefox-gobject-2_0-0Upgrade libnghttp2_asio-develUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-glib-2_0-0Upgrade firefox-libcairo-gobject2Upgrade nodejs8-docsUpgrade python3-nghttp2Upgrade firefox-gdk-pixbuf-query-loadersUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs12Upgrade libnghttp2-develUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-otherUpgrade nghttp2Upgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade firefox-libcairo2Upgrade libnghttp2-14-32bitUpgrade libnghttp2_asio1Upgrade firefox-libgtk-3-0Upgrade vim-plugin-nginxUpgrade libsoftokn3-32bitUpgrade nodejs12-docsUpgrade libfirefox-gthread-2_0-0Upgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade mozilla-nss-develUpgrade nginx-sourceUpgrade firefox-libharfbuzz0Upgrade firefox-glib2-langUpgrade libnghttp2_asio1-32bitUpgrade firefox-gtk3-langUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-multipress | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-lightUpgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-coreUpgrade nghttp2-serverUpgrade nginx-commonUpgrade nghttp2-proxyUpgrade nghttp2-server (Ubuntu Pro)Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nginx-extrasUpgrade nginx-fullUpgrade libnghttp2-14Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2Upgrade nghttp2 (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub