Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginx | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginx-debugsourceUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nodejs-docsUpgrade nginxUpgrade npmUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filter | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nodeUpgrade node10Upgrade nginxUpgrade node8Upgrade nginx-devel | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-perl | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nodejsUpgrade nginx-mod-streamUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginxUpgrade nodejs-develUpgrade nodejs-docsUpgrade nginx-all-modulesUpgrade npmUpgrade nodejs-nodemonUpgrade nginx-filesystem | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nodejs-nodemonUpgrade npmUpgrade nginx-all-modulesUpgrade nginx-debugsourceUpgrade nodejs-packagingUpgrade nginx-mod-http-perlUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-debugsourceUpgrade nodejs-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-docsUpgrade nginxUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nginx-filesystemUpgrade nodejsUpgrade nodejs-devel-debuginfo | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs8Upgrade nodejs12-develUpgrade mozillafirefox-translations-otherUpgrade nodejs8-develUpgrade firefox-libatk-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade nodejs10Upgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-toolsUpgrade libsoftokn3Upgrade libfirefox-glib-2_0-0Upgrade npm12Upgrade mozilla-nss-certsUpgrade mozilla-nss-32bitUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-dataUpgrade firefox-glib2-toolsUpgrade firefox-glib2-langUpgrade firefox-gtk3-langUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nss-develUpgrade nodejs12-docsUpgrade nodejs12Upgrade firefox-libpango-1_0-0Upgrade mozillafirefoxUpgrade libsoftokn3-32bitUpgrade nodejs10-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs10-develUpgrade nodejs8-docsUpgrade libfreebl3-32bitUpgrade nginxUpgrade firefox-libharfbuzz0Upgrade npm10Upgrade firefox-gtk3-immodule-thaiUpgrade nginx-sourceUpgrade libfirefox-gthread-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nssUpgrade libfreebl3Upgrade firefox-libcairo2Upgrade mozilla-nspr-develUpgrade firefox-libgtk-3-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-ximUpgrade vim-plugin-nginxUpgrade libfirefox-gmodule-2_0-0Upgrade mozillafirefox-translations-commonUpgrade npm8Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-libcairo-gobject2Upgrade firefox-libffi7Upgrade firefox-atk-langUpgrade libfirefox-gobject-2_0-0Upgrade mozillafirefox-branding-sledUpgrade firefox-gtk3-toolsUpgrade mozilla-nsprUpgrade firefox-libffi4 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-commonUpgrade nginx-fullUpgrade nginx-extrasUpgrade nginx-lightUpgrade nginx-core | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub