Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginxUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nghttp2Upgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2-develUpgrade nghttp2Upgrade nghttp2-debuginfoUpgrade mod_http2Upgrade libnghttp2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-mailUpgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade libnghttp2Upgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejsUpgrade libnghttp2-debuginfoUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nghttp2-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade npmUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nghttp2-debuginfoUpgrade nginx-mod-http-xslt-filter | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nghttp2Upgrade nginxUpgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade nginx-develUpgrade nghttp2Upgrade node8Upgrade nodeUpgrade node10Upgrade libnghttp2 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-all-modules | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nodejsUpgrade nodejs-packagingUpgrade nginxUpgrade olcne-nginxUpgrade nginx-mod-http-perlUpgrade olcnectlUpgrade nginx-all-modulesUpgrade nodejs-develUpgrade olcne-utilsUpgrade olcne-agentUpgrade nghttp2Upgrade nginx-filesystemUpgrade libnghttp2Upgrade nginx-mod-streamUpgrade libnghttp2-develUpgrade nodejs-docsUpgrade olcne-istio-chartUpgrade nodejs-nodemonUpgrade olcne-api-serverUpgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade olcne-prometheus-chart | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade libnghttp2Upgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nghttp2-debugsourceUpgrade nginx-all-modulesUpgrade nodejs-debuginfoUpgrade nginx-mod-mailUpgrade libnghttp2-develUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade libnghttp2-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nghttp2Upgrade nginxUpgrade nghttp2-debuginfoUpgrade nodejsUpgrade npm | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libffi4Upgrade libfirefox-gobject-2_0-0Upgrade python3-nghttp2Upgrade libnghttp2-14Upgrade nodejs8-docsUpgrade nodejs8Upgrade nodejs10-develUpgrade firefox-libcairo-gobject2Upgrade npm12Upgrade libfreebl3Upgrade npm10Upgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nsprUpgrade nginxUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-32bitUpgrade libfreebl3-32bitUpgrade npm8Upgrade libnghttp2_asio-develUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-glib-2_0-0Upgrade firefox-libffi7Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-atk-langUpgrade MozillaFirefoxUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs10-docsUpgrade nodejs10Upgrade mozilla-nss-certsUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-glib2-toolsUpgrade nodejs12-develUpgrade nodejs8-develUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-langUpgrade libsoftokn3-32bitUpgrade libnghttp2_asio1Upgrade nginx-sourceUpgrade libnghttp2-14-32bitUpgrade libnghttp2-develUpgrade firefox-gtk3-dataUpgrade libnghttp2_asio1-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade MozillaFirefox-translations-otherUpgrade nodejs12-docsUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libgtk-3-0Upgrade nodejs12Upgrade firefox-glib2-langUpgrade vim-plugin-nginxUpgrade mozilla-nspr-32bitUpgrade mozilla-nssUpgrade mozilla-nss-develUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libharfbuzz0Upgrade mozilla-nspr-develUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nghttp2Upgrade libsoftokn3Upgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-libcairo2 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-serverUpgrade nginx-lightUpgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-coreUpgrade nghttp2-server (Ubuntu Pro)Upgrade nginx-commonUpgrade nghttp2-clientUpgrade nginx-fullUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nginx-extrasUpgrade libnghttp2-14Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nghttp2 | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub