Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modules | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade nginx | May 8, 2020 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-mail-debuginfoUpgrade nginx-all-modulesUpgrade nodejs-docsUpgrade nginx-mod-http-perlUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-develUpgrade nginx-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade nginx-filesystem | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginx | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nodeUpgrade node10Upgrade nginxUpgrade nginx-develUpgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-all-modulesUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-filesystem | Sep 30, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Nov 20, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginxUpgrade nginx-mod-http-xslt-filterUpgrade nodejsUpgrade nginx-mod-streamUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade npmUpgrade nodejs-docsUpgrade nginx-filesystemUpgrade nodejs-develUpgrade nginx-all-modules | Oct 5, 2022 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-docsUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nodejs-develUpgrade nginxUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-debugsourceUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filterUpgrade nginx-debuginfo | Sep 20, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-perlUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginxUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-stream-debuginfoUpgrade nginx-debugsource | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade npm8Upgrade nginxUpgrade libfreebl3Upgrade mozilla-nssUpgrade firefox-libcairo2Upgrade firefox-libharfbuzz0Upgrade firefox-libcairo-gobject2Upgrade firefox-gio-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade vim-plugin-nginxUpgrade npm10Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nspr-32bitUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libgtk-3-0Upgrade firefox-atk-langUpgrade mozilla-nspr-develUpgrade nginx-sourceUpgrade firefox-libffi7Upgrade firefox-gtk3-toolsUpgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libffi4Upgrade mozilla-nsprUpgrade mozillafirefox-branding-sledUpgrade mozilla-nss-develUpgrade nodejs8-develUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozillafirefoxUpgrade libfirefox-glib-2_0-0Upgrade nodejs10-docsUpgrade libsoftokn3-32bitUpgrade libfreebl3-32bitUpgrade firefox-gtk3-langUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-vietnameseUpgrade libsoftokn3Upgrade firefox-gtk3-immodule-amharicUpgrade mozilla-nss-certsUpgrade libfirefox-gio-2_0-0Upgrade nodejs12-docsUpgrade mozilla-nss-32bitUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs12Upgrade npm12Upgrade nodejs8-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libpango-1_0-0Upgrade mozilla-nss-toolsUpgrade firefox-glib2-langUpgrade firefox-glib2-toolsUpgrade nodejs10-develUpgrade nodejs12-develUpgrade mozilla-nss-certs-32bitUpgrade nodejs10Upgrade mozillafirefox-translations-otherUpgrade nodejs8 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-lightUpgrade nginx-coreUpgrade nginx-extrasUpgrade nginx-commonUpgrade nginx-full | Aug 16, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub