Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade containerdUpgrade nodejsUpgrade py3-twistedUpgrade h2o | Aug 22, 2024 | Aug 13, 2019 |
| Arista Eos | — | Upgrade to a remediated version or install provided hotfix | Sep 4, 2024 | Nov 6, 2019 |
| Centos_linux | — | Upgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nodejs-debuginfo | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade h2oUpgrade trafficserver | Oct 23, 2019 | Aug 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 20, 2019 |
| Freebsd | — | Upgrade py37-twistedUpgrade py35-twistedUpgrade nodeUpgrade node8Upgrade py36-twistedUpgrade h2o-develUpgrade node10Upgrade h2oUpgrade py38-twistedUpgrade py27-twisted | Apr 21, 2020 | Aug 25, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat Openshift | — | Upgrade sriov-network-device-plugin | Oct 8, 2019 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade npmUpgrade nodejs | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs8-develUpgrade nodejs8-docsUpgrade mozilla-nspr-develUpgrade python3-twistedUpgrade npm12Upgrade firefox-libffi7Upgrade nodejs12Upgrade libfreebl3-32bitUpgrade firefox-glib2-langUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs8Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nsprUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs10-docsUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nss-develUpgrade nodejs12-develUpgrade firefox-gtk3-dataUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-libharfbuzz0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libfreebl3Upgrade firefox-atk-langUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade nodejs12-docsUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-toolsUpgrade mozillafirefox-translations-otherUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libgtk-3-0Upgrade firefox-libffi4Upgrade mozilla-nss-certsUpgrade libfirefox-glib-2_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-glib2-toolsUpgrade mozilla-nss-certs-32bitUpgrade mozillafirefox-branding-sledUpgrade npm8Upgrade firefox-libpango-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libcairo2Upgrade firefox-libatk-1_0-0Upgrade npm10Upgrade nodejs10-develUpgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade mozilla-nssUpgrade nodejs10Upgrade mozillafirefoxUpgrade firefox-gtk3-langUpgrade libsoftokn3 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade python-twisted-webUpgrade python-twistedUpgrade python-twisted-binUpgrade libnetty-java (Ubuntu Pro)Upgrade python3-twistedUpgrade python3-twisted-bin | Mar 20, 2020 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub