Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginxUpgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nodejs-packagingUpgrade nginx-filesystem | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nodejsUpgrade nghttp2 | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2Upgrade libnghttp2-develUpgrade nghttp2-debuginfoUpgrade libnghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-image-filter-debuginfoUpgrade npmUpgrade nginx-mod-mailUpgrade nodejs-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-stream-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade nginxUpgrade nodejs-nodemonUpgrade nghttp2-debugsourceUpgrade nginx-mod-streamUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nodejs-devel-debuginfoUpgrade nginx-debuginfoUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nodejs-docsUpgrade nginx-mod-http-xslt-filterUpgrade nodejs | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nghttp2Upgrade nginxUpgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade nginx-develUpgrade nodeUpgrade nghttp2Upgrade libnghttp2Upgrade node10Upgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx | Sep 30, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-packagingUpgrade libnghttp2Upgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-develUpgrade nodejs-docsUpgrade nghttp2Upgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade libnghttp2-develUpgrade nginx-mod-http-perlUpgrade npmUpgrade nginxUpgrade nginx-mod-mail | Jul 21, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-docsUpgrade libnghttp2-debuginfoUpgrade nginx-debuginfoUpgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade libnghttp2-develUpgrade npmUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nghttp2Upgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-debugsourceUpgrade nghttp2-debugsourceUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debuginfoUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debugsource | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade python3-nghttp2Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libnghttp2_asio1Upgrade mozilla-nssUpgrade firefox-gdk-pixbuf-langUpgrade MozillaFirefox-translations-commonUpgrade mozilla-nsprUpgrade libnghttp2-14-32bitUpgrade nginxUpgrade libnghttp2_asio-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-toolsUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-thaiUpgrade npm8Upgrade nginx-sourceUpgrade vim-plugin-nginxUpgrade firefox-libgtk-3-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-branding-upstreamUpgrade npm12Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nspr-develUpgrade nghttp2Upgrade firefox-libffi4Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-atk-langUpgrade npm10Upgrade libfreebl3Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade libnghttp2-develUpgrade firefox-gtk3-immodule-ximUpgrade libnghttp2-14Upgrade libfirefox-gthread-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-dataUpgrade nodejs10Upgrade firefox-libatk-1_0-0Upgrade libsoftokn3Upgrade MozillaFirefox-translations-otherUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs10-develUpgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-toolsUpgrade nodejs12-docsUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-glib2-toolsUpgrade nodejs8-develUpgrade nodejs8-docsUpgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade mozilla-nss-certs-32bitUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs12-develUpgrade firefox-gtk3-langUpgrade nodejs10-docsUpgrade nodejs8Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-libcairo2Upgrade libnghttp2_asio1-32bitUpgrade nodejs12Upgrade libfirefox-gio-2_0-0Upgrade libsoftokn3-32bitUpgrade libfreebl3-32bitUpgrade firefox-glib2-langUpgrade mozilla-nss-devel | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-serverUpgrade nghttp2-proxyUpgrade nghttp2Upgrade nghttp2-clientUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade nginx-coreUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nginx-fullUpgrade nginx-commonUpgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-lightUpgrade nghttp2-server (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nginx-extrasUpgrade nghttp2 (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub