Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade containerdUpgrade nodejsUpgrade h2oUpgrade py3-twisted | Aug 22, 2024 | Aug 13, 2019 |
| Arista Eos | — | Upgrade to a remediated version or install provided hotfix | Sep 4, 2024 | Nov 6, 2019 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docs | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade h2oUpgrade trafficserver | Oct 23, 2019 | Aug 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 20, 2019 |
| Freebsd | — | Upgrade py27-twistedUpgrade py38-twistedUpgrade node10Upgrade h2oUpgrade h2o-develUpgrade py35-twistedUpgrade node8Upgrade py37-twistedUpgrade nodeUpgrade py36-twisted | Apr 21, 2020 | Aug 25, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejsUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-devel | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat Openshift | — | Upgrade sriov-network-device-plugin | Oct 8, 2019 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejsUpgrade npmUpgrade nodejs-debugsourceUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-devel-debuginfo | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-libcairo2Upgrade nodejs10-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-ximUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-32bitUpgrade libsoftokn3Upgrade nodejs10Upgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade firefox-gtk3-langUpgrade firefox-libffi4Upgrade mozilla-nss-certsUpgrade firefox-gtk3-toolsUpgrade firefox-libatk-1_0-0Upgrade firefox-glib2-toolsUpgrade npm10Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-libpango-1_0-0Upgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade libfirefox-glib-2_0-0Upgrade npm8Upgrade nodejs12-develUpgrade libfreebl3-32bitUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libffi7Upgrade nodejs10-docsUpgrade firefox-glib2-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs12-docsUpgrade firefox-gtk3-dataUpgrade mozilla-nss-develUpgrade nodejs12Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libharfbuzz0Upgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gthread-2_0-0Upgrade python3-twistedUpgrade mozilla-nspr-develUpgrade firefox-libcairo-gobject2Upgrade mozilla-nspr-32bitUpgrade npm12Upgrade nodejs8-develUpgrade libsoftokn3-32bitUpgrade nodejs8-docsUpgrade MozillaFirefoxUpgrade mozilla-nsprUpgrade firefox-atk-langUpgrade nodejs8Upgrade libfreebl3Upgrade firefox-gdk-pixbuf-thumbnailer | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade python-twisted-webUpgrade python3-twistedUpgrade python-twisted-binUpgrade python3-twisted-binUpgrade python-twistedUpgrade libnetty-java (Ubuntu Pro) | Mar 20, 2020 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub