Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginxUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginx | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nodejs-nodemonUpgrade npmUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-all-modulesUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nodejs-docsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-streamUpgrade nodejs-debugsourceUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-debuginfoUpgrade nginx-debugsourceUpgrade nodejs-debuginfoUpgrade nginx-mod-mail | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginx-develUpgrade node8Upgrade node10Upgrade nodeUpgrade nginx | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystem | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-develUpgrade npmUpgrade nodejs-docsUpgrade nodejs-nodemonUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-http-perlUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-mod-http-xslt-filter | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade npmUpgrade nginx-debuginfoUpgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nodejs-debugsourceUpgrade nginx-mod-mailUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-packagingUpgrade nginx-debugsourceUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-docsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nodejs-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-filesystem | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perl | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade libfreebl3Upgrade mozilla-nssUpgrade firefox-libcairo2Upgrade npm10Upgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefox-translations-commonUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nsprUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libgtk-3-0Upgrade firefox-gio-branding-upstreamUpgrade mozilla-nspr-32bitUpgrade nginx-sourceUpgrade npm8Upgrade firefox-gtk3-toolsUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-branding-upstreamUpgrade nginxUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libffi7Upgrade vim-plugin-nginxUpgrade firefox-atk-langUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libffi4Upgrade MozillaFirefox-branding-SLEDUpgrade nodejs12Upgrade nodejs12-docsUpgrade npm12Upgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-langUpgrade nodejs10-develUpgrade nodejs10Upgrade nodejs12-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-dataUpgrade libfirefox-gio-2_0-0Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-certsUpgrade libsoftokn3Upgrade mozilla-nss-develUpgrade mozilla-nss-certs-32bitUpgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade nodejs10-docsUpgrade nodejs8Upgrade MozillaFirefox-translations-otherUpgrade firefox-glib2-langUpgrade nodejs8-docsUpgrade nodejs8-develUpgrade MozillaFirefoxUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade libfreebl3-32bit | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-commonUpgrade nginx-coreUpgrade nginx-light | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub