Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nodejs | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-docsUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-filesystemUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-debugsource | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginx-develUpgrade node8Upgrade node10Upgrade nginxUpgrade node | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade npmUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-filesystemUpgrade nodejs-develUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nginx-mod-streamUpgrade nginxUpgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mail | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-devel-debuginfoUpgrade nodejs-develUpgrade nginx-mod-stream-debuginfoUpgrade nginxUpgrade nodejs-debuginfoUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-docsUpgrade nodejsUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nodejs-debugsourceUpgrade npmUpgrade nginx-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-nodemonUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mailUpgrade nginx-debugsourceUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filter | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozilla-nss-certsUpgrade mozilla-nss-32bitUpgrade nodejs12-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade libsoftokn3Upgrade firefox-glib2-langUpgrade mozillafirefox-translations-otherUpgrade nodejs10-develUpgrade nodejs12-develUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-develUpgrade firefox-libatk-1_0-0Upgrade nodejs10-docsUpgrade firefox-glib2-toolsUpgrade firefox-libpango-1_0-0Upgrade nodejs8-develUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefoxUpgrade nodejs12Upgrade firefox-gtk3-dataUpgrade npm12Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-toolsUpgrade mozilla-nss-certs-32bitUpgrade libfreebl3-32bitUpgrade firefox-gtk3-langUpgrade nodejs8-docsUpgrade libsoftokn3-32bitUpgrade nodejs10Upgrade libfirefox-gio-2_0-0Upgrade nodejs8Upgrade mozilla-nsprUpgrade firefox-gtk3-toolsUpgrade mozillafirefox-translations-commonUpgrade firefox-atk-langUpgrade firefox-libffi4Upgrade firefox-libcairo-gobject2Upgrade firefox-libharfbuzz0Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi7Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade nginxUpgrade vim-plugin-nginxUpgrade npm10Upgrade libfreebl3Upgrade mozilla-nssUpgrade firefox-libcairo2Upgrade nginx-sourceUpgrade mozilla-nspr-32bitUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libgtk-3-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nspr-develUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gthread-2_0-0Upgrade npm8Upgrade libfirefox-gmodule-2_0-0Upgrade mozillafirefox-branding-sled | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-lightUpgrade nginx-coreUpgrade nginx-commonUpgrade nginx-fullUpgrade nginx-extras | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub