Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginxUpgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nginx-mod-stream | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginx | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nginx-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-debugsourceUpgrade nodejs-packagingUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-docsUpgrade nginx-mod-stream-debuginfoUpgrade nodejsUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-streamUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-all-modulesUpgrade npmUpgrade nodejs-nodemonUpgrade nginx-mod-http-image-filter | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade nodeUpgrade nginxUpgrade nginx-develUpgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nodejs-docsUpgrade nodejs-develUpgrade npmUpgrade nodejs-nodemonUpgrade nginx-filesystemUpgrade nginx-all-modulesUpgrade nodejs-packagingUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-docsUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-filesystemUpgrade nodejs-develUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nodejs-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-debugsourceUpgrade nginx-all-modulesUpgrade nodejs-packagingUpgrade nginx-debugsourceUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-nodemonUpgrade npm | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-mod-streamUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filter-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade vim-plugin-nginxUpgrade npm10Upgrade firefox-gtk3-immodule-thaiUpgrade libfreebl3Upgrade firefox-libharfbuzz0Upgrade firefox-libcairo2Upgrade mozilla-nssUpgrade nginxUpgrade mozilla-nspr-32bitUpgrade libfirefox-gthread-2_0-0Upgrade firefox-libgtk-3-0Upgrade mozilla-nsprUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi4Upgrade libfirefox-gmodule-2_0-0Upgrade npm8Upgrade firefox-atk-langUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gobject-2_0-0Upgrade mozilla-nspr-develUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-toolsUpgrade firefox-libffi7Upgrade nginx-sourceUpgrade MozillaFirefoxUpgrade nodejs12-develUpgrade nodejs10-develUpgrade nodejs8-develUpgrade nodejs12-docsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-langUpgrade nodejs8-docsUpgrade mozilla-nss-32bitUpgrade npm12Upgrade mozilla-nss-certsUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade firefox-libpango-1_0-0Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade libfirefox-gio-2_0-0Upgrade nodejs10-docsUpgrade firefox-glib2-toolsUpgrade nodejs8Upgrade mozilla-nss-develUpgrade mozilla-nss-certs-32bitUpgrade libfirefox-glib-2_0-0Upgrade nodejs10Upgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-inuktitutUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-glib2-langUpgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gtk3-immodule-amharic | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-commonUpgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-coreUpgrade nginx-light | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub