Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filter | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginx | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-debugsourceUpgrade nginx-filesystemUpgrade nginx-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nginx-debugsourceUpgrade nginx-mod-mailUpgrade nginx-mod-stream-debuginfoUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejsUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filter | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade nginx-develUpgrade nodeUpgrade node10Upgrade nginx | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-all-modules | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-all-modulesUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nginx-filesystemUpgrade nginxUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mail | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nodejs-debugsourceUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsourceUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-packagingUpgrade nginx-mod-mail-debuginfoUpgrade nginx-all-modulesUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-filesystemUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nginx-mod-stream | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginxUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-perl | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs12-develUpgrade libsoftokn3-32bitUpgrade nodejs10-develUpgrade firefox-gtk3-dataUpgrade libfirefox-gio-2_0-0Upgrade nodejs10Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-toolsUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-langUpgrade nodejs12Upgrade libsoftokn3Upgrade nodejs10-docsUpgrade firefox-glib2-langUpgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade nodejs8Upgrade firefox-gtk3-immodules-tigrignaUpgrade nodejs8-develUpgrade MozillaFirefoxUpgrade firefox-libatk-1_0-0Upgrade mozilla-nss-develUpgrade nodejs8-docsUpgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-translations-otherUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-certsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12-docsUpgrade libfreebl3-32bitUpgrade npm12Upgrade firefox-libcairo2Upgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nssUpgrade libfreebl3Upgrade nginxUpgrade npm10Upgrade libfirefox-gmodule-2_0-0Upgrade npm8Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gdk-pixbuf-query-loadersUpgrade vim-plugin-nginxUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-branding-upstreamUpgrade mozilla-nsprUpgrade firefox-libffi4Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-multipressUpgrade libfirefox-gthread-2_0-0Upgrade nginx-sourceUpgrade mozilla-nspr-develUpgrade mozilla-nspr-32bitUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade firefox-gtk3-toolsUpgrade firefox-atk-langUpgrade MozillaFirefox-translations-common | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-extrasUpgrade nginx-commonUpgrade nginx-fullUpgrade nginx-coreUpgrade nginx-light | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub