Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perl | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2Upgrade libnghttp2-develUpgrade nghttp2-debuginfoUpgrade libnghttp2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-filesystemUpgrade nodejs-docsUpgrade nginx-debuginfoUpgrade nginx-mod-streamUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-devel-debuginfoUpgrade nghttp2-debugsourceUpgrade nodejs-nodemonUpgrade libnghttp2Upgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-develUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nghttp2-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-mod-mailUpgrade npm | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginxUpgrade nodejsUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginx-develUpgrade nodeUpgrade nghttp2Upgrade nginxUpgrade libnghttp2Upgrade node10Upgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter | Sep 30, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginxUpgrade nginx-all-modulesUpgrade nghttp2Upgrade nginx-filesystemUpgrade npmUpgrade nginx-mod-mailUpgrade libnghttp2-develUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade libnghttp2 | Jul 21, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-stream-debuginfoUpgrade nghttp2-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade npmUpgrade nginx-mod-http-image-filter-debuginfoUpgrade libnghttp2-develUpgrade nodejs-docsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-debuginfoUpgrade libnghttp2-debuginfoUpgrade nodejs-devel-debuginfoUpgrade libnghttp2Upgrade nodejs-develUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nodejs-debugsourceUpgrade nginx-all-modulesUpgrade nodejsUpgrade nginxUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade nginx-debugsourceUpgrade nginx-mod-http-perlUpgrade nghttp2-debugsourceUpgrade nghttp2Upgrade nodejs-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-image-filter | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-debuginfoUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mail | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade mozilla-nssUpgrade libnghttp2_asio-develUpgrade mozilla-nsprUpgrade python3-nghttp2Upgrade firefox-atk-langUpgrade libfreebl3Upgrade libnghttp2-14-32bitUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-toolsUpgrade nginxUpgrade firefox-libgtk-3-0Upgrade nghttp2Upgrade firefox-gdk-pixbuf-langUpgrade libnghttp2-develUpgrade npm10Upgrade firefox-gio-branding-upstreamUpgrade libfirefox-gobject-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libffi4Upgrade libnghttp2_asio1Upgrade firefox-gtk3-branding-upstreamUpgrade vim-plugin-nginxUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libcairo-gobject2Upgrade libnghttp2-14Upgrade libfirefox-gmodule-2_0-0Upgrade npm12Upgrade nginx-sourceUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefox-branding-sledUpgrade npm8Upgrade mozillafirefox-translations-commonUpgrade firefox-libffi7Upgrade libfirefox-gthread-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-develUpgrade nodejs8-develUpgrade nodejs10-develUpgrade libsoftokn3-32bitUpgrade libnghttp2_asio1-32bitUpgrade mozilla-nss-toolsUpgrade libsoftokn3Upgrade mozilla-nspr-32bitUpgrade mozilla-nss-32bitUpgrade nodejs10-docsUpgrade firefox-gtk3-dataUpgrade firefox-libcairo2Upgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gio-2_0-0Upgrade nodejs12-docsUpgrade nodejs12Upgrade nodejs10Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-multipressUpgrade nodejs12-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-langUpgrade firefox-glib2-toolsUpgrade mozillafirefox-translations-otherUpgrade firefox-libatk-1_0-0Upgrade nodejs8 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-coreUpgrade nghttp2-serverUpgrade nginx-fullUpgrade nghttp2-proxyUpgrade nghttp2Upgrade nginx-commonUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-clientUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nginx-lightUpgrade libnghttp2-14Upgrade nginx-extrasUpgrade nghttp2-client (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub