Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginxUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nginx-filesystemUpgrade nginx-all-modules | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2Upgrade libnghttp2-develUpgrade libnghttp2Upgrade nghttp2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-mail-debuginfoUpgrade nodejs-develUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-nodemonUpgrade libnghttp2-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-debuginfoUpgrade npmUpgrade nginx-mod-stream-debuginfoUpgrade nginxUpgrade nginx-all-modulesUpgrade libnghttp2Upgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-docsUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nghttp2-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade nginx-debuginfoUpgrade nodejs | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginxUpgrade nodejsUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginx-develUpgrade nodeUpgrade nginxUpgrade nghttp2Upgrade node10Upgrade libnghttp2Upgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-all-modulesUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl | Sep 30, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginxUpgrade nghttp2Upgrade libnghttp2-develUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade npmUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade libnghttp2Upgrade nodejs-docsUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nodejs-develUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nodejs | Jul 21, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade libnghttp2-develUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade npmUpgrade libnghttp2Upgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-streamUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nghttp2Upgrade nodejs-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade nodejs-nodemonUpgrade nghttp2-debugsourceUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nodejs-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade mozillafirefox-branding-sledUpgrade libnghttp2-14Upgrade firefox-gtk3-immodule-thaiUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libffi7Upgrade firefox-libcairo-gobject2Upgrade mozilla-nssUpgrade nghttp2Upgrade vim-plugin-nginxUpgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade npm12Upgrade libfirefox-gobject-2_0-0Upgrade nginx-sourceUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-toolsUpgrade libnghttp2_asio1Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-atk-langUpgrade libnghttp2-develUpgrade nginxUpgrade npm10Upgrade firefox-gio-branding-upstreamUpgrade firefox-libgtk-3-0Upgrade mozilla-nsprUpgrade libnghttp2-14-32bitUpgrade firefox-libffi4Upgrade firefox-gdk-pixbuf-langUpgrade libnghttp2_asio-develUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-branding-upstreamUpgrade libfreebl3Upgrade mozillafirefox-translations-commonUpgrade python3-nghttp2Upgrade npm8Upgrade mozilla-nss-certsUpgrade nodejs8Upgrade nodejs8-develUpgrade mozilla-nss-32bitUpgrade libnghttp2_asio1-32bitUpgrade firefox-libcairo2Upgrade libsoftokn3-32bitUpgrade nodejs8-docsUpgrade libsoftokn3Upgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gio-2_0-0Upgrade mozillafirefox-translations-otherUpgrade nodejs12-develUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libharfbuzz0Upgrade nodejs12-docsUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs10-docsUpgrade mozilla-nspr-32bitUpgrade firefox-libatk-1_0-0Upgrade mozilla-nss-develUpgrade firefox-gtk3-dataUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs10Upgrade firefox-libpango-1_0-0Upgrade nodejs12Upgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade firefox-glib2-langUpgrade mozilla-nss-certs-32bitUpgrade nodejs10-devel | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-server (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nginx-extrasUpgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-lightUpgrade nghttp2 (Ubuntu Pro)Upgrade nginx-fullUpgrade nghttp2-proxyUpgrade nginx-commonUpgrade nghttp2-serverUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nginx-coreUpgrade nghttp2Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-client | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub