Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade h2oUpgrade py3-twistedUpgrade nodejsUpgrade containerd | Aug 22, 2024 | Aug 13, 2019 |
| Arista Eos | — | Upgrade to a remediated version or install provided hotfix | Sep 4, 2024 | Nov 6, 2019 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-packaging | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade h2oUpgrade trafficserver | Oct 23, 2019 | Aug 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 20, 2019 |
| Freebsd | — | Upgrade h2o-develUpgrade py38-twistedUpgrade py27-twistedUpgrade h2oUpgrade node10Upgrade py37-twistedUpgrade py36-twistedUpgrade nodeUpgrade py35-twistedUpgrade node8 | Apr 21, 2020 | Aug 25, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade npm | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat Openshift | — | Upgrade sriov-network-device-plugin | Oct 8, 2019 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejsUpgrade npm | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade mozilla-nssUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade firefox-libcairo2Upgrade firefox-libffi4Upgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-toolsUpgrade libfirefox-glib-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nss-certsUpgrade npm8Upgrade nodejs10-develUpgrade mozillafirefoxUpgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-langUpgrade mozilla-nss-certs-32bitUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade nodejs10Upgrade firefox-libgtk-3-0Upgrade mozilla-nss-toolsUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade npm10Upgrade libsoftokn3-32bitUpgrade npm12Upgrade nodejs8-develUpgrade firefox-libcairo-gobject2Upgrade python3-twistedUpgrade mozilla-nspr-develUpgrade libfirefox-gobject-2_0-0Upgrade nodejs8-docsUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gio-branding-upstreamUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12-develUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nss-develUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs12-docsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-dataUpgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3-32bitUpgrade nodejs12Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs8Upgrade firefox-gdk-pixbuf-langUpgrade firefox-libharfbuzz0Upgrade mozilla-nsprUpgrade mozilla-nspr-32bitUpgrade libfreebl3Upgrade firefox-atk-langUpgrade firefox-libffi7 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade python-twisted-webUpgrade python-twistedUpgrade python-twisted-binUpgrade python3-twistedUpgrade libnetty-java (Ubuntu Pro)Upgrade python3-twisted-bin | Mar 20, 2020 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub