Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginxUpgrade nginx-all-modulesUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nodejs-nodemonUpgrade nginx-filesystem | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nginxUpgrade nodejs | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2-develUpgrade nghttp2Upgrade libnghttp2Upgrade nghttp2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nginx-mod-mailUpgrade nghttp2-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-all-modulesUpgrade nodejs-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-nodemonUpgrade nginxUpgrade libnghttp2Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejsUpgrade nodejs-packagingUpgrade nginx-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-docsUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nodejs-devel-debuginfoUpgrade nodejs-debugsourceUpgrade nghttp2-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade libnghttp2Upgrade nodeUpgrade nghttp2Upgrade nginx-develUpgrade nginx | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystem | Sep 30, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-perlUpgrade npmUpgrade nginx-filesystemUpgrade libnghttp2-develUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nghttp2Upgrade nodejs-docsUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade libnghttp2Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filter | Jul 21, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade npmUpgrade nodejs-devel-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade libnghttp2-debuginfoUpgrade libnghttp2Upgrade nghttp2-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade libnghttp2-develUpgrade nodejs-docsUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nginx-debugsourceUpgrade nghttp2Upgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nodejs-packagingUpgrade nginxUpgrade nghttp2-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs12-develUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nss-certsUpgrade firefox-libharfbuzz0Upgrade firefox-libcairo2Upgrade libsoftokn3Upgrade libnghttp2_asio1-32bitUpgrade libsoftokn3-32bitUpgrade mozilla-nss-32bitUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs10Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-dataUpgrade mozillafirefox-translations-otherUpgrade firefox-libatk-1_0-0Upgrade firefox-glib2-toolsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs10-docsUpgrade mozilla-nss-toolsUpgrade firefox-glib2-langUpgrade libfreebl3-32bitUpgrade mozillafirefoxUpgrade mozilla-nss-develUpgrade libfirefox-gio-2_0-0Upgrade nodejs12-docsUpgrade nodejs12Upgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-develUpgrade mozilla-nss-certs-32bitUpgrade nodejs8Upgrade nodejs10-develUpgrade firefox-libffi4Upgrade npm12Upgrade libfirefox-gthread-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade mozilla-nsprUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-toolsUpgrade libfirefox-gobject-2_0-0Upgrade mozillafirefox-branding-sledUpgrade firefox-libffi7Upgrade libnghttp2-14Upgrade libnghttp2-develUpgrade npm10Upgrade npm8Upgrade libfreebl3Upgrade mozillafirefox-translations-commonUpgrade python3-nghttp2Upgrade firefox-atk-langUpgrade vim-plugin-nginxUpgrade nginx-sourceUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-branding-upstreamUpgrade nghttp2Upgrade mozilla-nssUpgrade libnghttp2-14-32bitUpgrade libnghttp2_asio1Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libcairo-gobject2Upgrade nginxUpgrade libnghttp2_asio-develUpgrade firefox-libgtk-3-0 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-serverUpgrade nghttp2-proxyUpgrade nginx-coreUpgrade nginx-commonUpgrade nghttp2Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nginx-fullUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade nginx-extrasUpgrade nginx-lightUpgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2-client (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nghttp2 (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub