Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-stream | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nodejs | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nodejs-develUpgrade nodejs-docsUpgrade npmUpgrade nodejs-nodemonUpgrade nginxUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-devel-debuginfoUpgrade nginx-filesystemUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-debugsourceUpgrade nginx-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node8Upgrade nginx-develUpgrade node10Upgrade nodeUpgrade nginx | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginx-mod-streamUpgrade nodejs | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nodejs-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nodejs-debugsourceUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filter | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsource | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade mozilla-nssUpgrade firefox-gtk3-immodule-multipressUpgrade MozillaFirefox-translations-commonUpgrade firefox-atk-langUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-langUpgrade vim-plugin-nginxUpgrade libfreebl3Upgrade firefox-libcairo2Upgrade firefox-libffi4Upgrade firefox-gdk-pixbuf-query-loadersUpgrade npm10Upgrade firefox-libffi7Upgrade mozilla-nspr-develUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libgtk-3-0Upgrade firefox-libharfbuzz0Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-toolsUpgrade npm8Upgrade libfirefox-gthread-2_0-0Upgrade mozilla-nspr-32bitUpgrade nginx-sourceUpgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nsprUpgrade nginxUpgrade nodejs12-docsUpgrade nodejs10Upgrade mozilla-nss-develUpgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3-32bitUpgrade npm12Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade libsoftokn3Upgrade mozilla-nss-certsUpgrade firefox-libatk-1_0-0Upgrade MozillaFirefoxUpgrade nodejs8-docsUpgrade nodejs8-develUpgrade libfreebl3-32bitUpgrade firefox-gtk3-langUpgrade mozilla-nss-32bitUpgrade nodejs12Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-toolsUpgrade libfirefox-glib-2_0-0Upgrade nodejs10-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs12-develUpgrade firefox-glib2-toolsUpgrade nodejs8Upgrade nodejs10-docsUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-dataUpgrade libfirefox-gio-2_0-0 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-commonUpgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-coreUpgrade nginx-light | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub