Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nodejs-nodemonUpgrade nginx-mod-stream | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nodejs | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade mod_http2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nginx-filesystemUpgrade nodejs-debuginfoUpgrade nginx-mod-mailUpgrade nginx-debugsourceUpgrade nodejs-packagingUpgrade nginx-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade nginx-develUpgrade nginxUpgrade nodeUpgrade node10 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginxUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nodejs-docsUpgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nodejsUpgrade nginx-mod-mailUpgrade nginx-mod-streamUpgrade nodejs-packaging | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-debugsourceUpgrade nodejs-packagingUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-mod-mail-debuginfoUpgrade npmUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mailUpgrade nginx-mod-stream-debuginfoUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-docsUpgrade nodejs-devel | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-gtk3-langUpgrade firefox-libpango-1_0-0Upgrade firefox-glib2-toolsUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-inuktitutUpgrade npm12Upgrade mozilla-nss-develUpgrade nodejs8-develUpgrade nodejs10Upgrade nodejs12-docsUpgrade libsoftokn3Upgrade mozilla-nss-32bitUpgrade libfirefox-glib-2_0-0Upgrade firefox-libatk-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs12Upgrade libfreebl3-32bitUpgrade mozillafirefox-translations-otherUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-certsUpgrade firefox-gtk3-dataUpgrade firefox-glib2-langUpgrade mozillafirefoxUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12-develUpgrade mozilla-nss-certs-32bitUpgrade nodejs8Upgrade nodejs10-develUpgrade nodejs10-docsUpgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade libsoftokn3-32bitUpgrade firefox-libffi4Upgrade firefox-libffi7Upgrade mozillafirefox-translations-commonUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nsprUpgrade firefox-gtk3-immodule-multipressUpgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-toolsUpgrade firefox-atk-langUpgrade mozilla-nspr-32bitUpgrade libfirefox-gthread-2_0-0Upgrade libfirefox-gmodule-2_0-0Upgrade firefox-libharfbuzz0Upgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-branding-upstreamUpgrade nginx-sourceUpgrade npm10Upgrade nginxUpgrade mozilla-nssUpgrade firefox-gtk3-immodule-thaiUpgrade vim-plugin-nginxUpgrade libfreebl3Upgrade firefox-libcairo2Upgrade npm8Upgrade firefox-libgtk-3-0Upgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nspr-devel | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-lightUpgrade nginx-coreUpgrade nginx-fullUpgrade nginx-commonUpgrade nginx-extras | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub