Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginx | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-filesystemUpgrade nodejs-debugsourceUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejsUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docs | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginx-develUpgrade node8Upgrade node10Upgrade nginxUpgrade node | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nodejs-packagingUpgrade nginxUpgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-mod-streamUpgrade nodejs-nodemonUpgrade nginx-all-modulesUpgrade nodejs-develUpgrade npmUpgrade nginx-filesystemUpgrade nodejs-docs | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nodejs-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-all-modulesUpgrade nginx-debugsourceUpgrade nodejs-packagingUpgrade npmUpgrade nginx-debuginfoUpgrade nginx-mod-http-perlUpgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-filesystemUpgrade nodejs-develUpgrade nginx-mod-stream-debuginfoUpgrade nginxUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-mail-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filter | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-langUpgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-develUpgrade firefox-libatk-1_0-0Upgrade nodejs8-docsUpgrade mozillafirefoxUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-32bitUpgrade npm12Upgrade mozilla-nss-certsUpgrade libsoftokn3Upgrade firefox-glib2-langUpgrade nodejs10-develUpgrade firefox-libpango-1_0-0Upgrade mozilla-nss-develUpgrade nodejs12-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-toolsUpgrade nodejs12-develUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade nodejs8Upgrade nodejs10-docsUpgrade nodejs12Upgrade nodejs10Upgrade mozillafirefox-translations-otherUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-glib2-toolsUpgrade mozilla-nspr-32bitUpgrade firefox-gio-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozillafirefox-branding-sledUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libgtk-3-0Upgrade vim-plugin-nginxUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi4Upgrade mozilla-nsprUpgrade firefox-atk-langUpgrade mozillafirefox-translations-commonUpgrade firefox-libffi7Upgrade npm8Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-toolsUpgrade libfirefox-gmodule-2_0-0Upgrade mozilla-nspr-develUpgrade firefox-libharfbuzz0Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-libcairo-gobject2Upgrade nginxUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-libcairo2Upgrade npm10Upgrade mozilla-nssUpgrade libfreebl3Upgrade firefox-gtk3-immodule-multipressUpgrade nginx-source | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-coreUpgrade nginx-lightUpgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-common | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub