Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade py3-twistedUpgrade h2oUpgrade containerdUpgrade nodejs | Aug 22, 2024 | Aug 13, 2019 |
| Arista Eos | — | Upgrade to a remediated version or install provided hotfix | Sep 4, 2024 | Nov 6, 2019 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade npmUpgrade nodejs-packagingUpgrade nodejs-devel-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade trafficserverUpgrade h2o | Oct 23, 2019 | Aug 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 20, 2019 |
| Freebsd | — | Upgrade py27-twistedUpgrade h2o-develUpgrade node10Upgrade h2oUpgrade py38-twistedUpgrade nodeUpgrade node8Upgrade py35-twistedUpgrade py37-twistedUpgrade py36-twisted | Apr 21, 2020 | Aug 25, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade npmUpgrade nodejs-devel | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat Openshift | — | Upgrade sriov-network-device-plugin | Oct 8, 2019 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade npmUpgrade nodejsUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-nodemonUpgrade nodejs-devel-debuginfo | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-libffi7Upgrade firefox-gio-branding-upstreamUpgrade libfreebl3-32bitUpgrade mozillafirefox-translations-commonUpgrade nodejs10-docsUpgrade mozilla-nspr-develUpgrade mozilla-nsprUpgrade nodejs8-develUpgrade nodejs12-docsUpgrade npm12Upgrade firefox-atk-langUpgrade firefox-gtk3-dataUpgrade libsoftokn3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade nodejs12-develUpgrade firefox-libcairo-gobject2Upgrade mozilla-nss-develUpgrade nodejs8-docsUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-glib2-langUpgrade mozilla-nspr-32bitUpgrade libfreebl3Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libharfbuzz0Upgrade firefox-gdk-pixbuf-langUpgrade nodejs8Upgrade firefox-gtk3-immodules-tigrignaUpgrade python3-twistedUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12Upgrade mozilla-nss-32bitUpgrade firefox-gtk3-langUpgrade nodejs10-develUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-toolsUpgrade mozilla-nss-certsUpgrade mozilla-nssUpgrade npm10Upgrade firefox-libatk-1_0-0Upgrade libsoftokn3Upgrade firefox-libffi4Upgrade libfirefox-gio-2_0-0Upgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-amharicUpgrade npm8Upgrade libfirefox-glib-2_0-0Upgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-ximUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozillafirefoxUpgrade firefox-libpango-1_0-0Upgrade nodejs10Upgrade mozillafirefox-branding-sledUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-certs-32bit | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade libnetty-java (Ubuntu Pro)Upgrade python3-twistedUpgrade python-twisted-binUpgrade python-twistedUpgrade python3-twisted-binUpgrade python-twisted-web | Mar 20, 2020 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub