Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade containerdUpgrade nodejsUpgrade h2oUpgrade py3-twisted | Aug 22, 2024 | Aug 13, 2019 |
| Arista Eos | — | Upgrade to a remediated version or install provided hotfix | Sep 4, 2024 | Nov 6, 2019 |
| Centos_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nodejs-packagingUpgrade npm | Oct 1, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade h2oUpgrade trafficserver | Oct 23, 2019 | Aug 13, 2019 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Aug 20, 2019 |
| Freebsd | — | Upgrade node8Upgrade py36-twistedUpgrade py35-twistedUpgrade py37-twistedUpgrade nodeUpgrade h2oUpgrade py27-twistedUpgrade py38-twistedUpgrade node10Upgrade h2o-devel | Apr 21, 2020 | Aug 25, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade nodejs-develUpgrade npm | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat Openshift | — | Upgrade sriov-network-device-plugin | Oct 8, 2019 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nodejs-devel-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs | Oct 1, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade libsoftokn3-32bitUpgrade nodejs12-docsUpgrade mozilla-nss-develUpgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3-32bitUpgrade nodejs10-docsUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libcairo-gobject2Upgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libharfbuzz0Upgrade nodejs8Upgrade libfreebl3Upgrade mozilla-nsprUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-glib2-langUpgrade nodejs12Upgrade firefox-gdk-pixbuf-langUpgrade nodejs12-develUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-atk-langUpgrade mozilla-nspr-develUpgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-dataUpgrade libfirefox-gthread-2_0-0Upgrade nodejs8-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libffi7Upgrade npm12Upgrade python3-twistedUpgrade mozilla-nss-certsUpgrade firefox-libpango-1_0-0Upgrade firefox-libffi4Upgrade mozilla-nssUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-toolsUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade libfirefox-glib-2_0-0Upgrade mozillafirefox-branding-sledUpgrade npm8Upgrade libfirefox-gio-2_0-0Upgrade libsoftokn3Upgrade firefox-libcairo2Upgrade firefox-libatk-1_0-0Upgrade npm10Upgrade nodejs10Upgrade mozillafirefox-translations-otherUpgrade firefox-gtk3-immodule-ximUpgrade nodejs10-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-langUpgrade mozillafirefoxUpgrade mozilla-nss-certs-32bit | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade libnetty-java (Ubuntu Pro)Upgrade python-twisted-binUpgrade python-twistedUpgrade python3-twisted-binUpgrade python3-twistedUpgrade python-twisted-web | Mar 20, 2020 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub