Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade apache2Upgrade nodejs | Aug 22, 2024 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade httpd24 | Oct 26, 2019 | Aug 13, 2019 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Aug 16, 2019 | Aug 13, 2019 |
| Centos_linux | — | Upgrade httpd-develUpgrade httpd-debuginfoUpgrade nodejs-devel-debuginfoUpgrade httpd-toolsUpgrade mod_http2-debuginfoUpgrade httpdUpgrade httpd-debugsourceUpgrade mod_ssl-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade nodejs-packagingUpgrade mod_http2-debugsourceUpgrade httpd-manualUpgrade httpd-tools-debuginfoUpgrade mod_session-debuginfoUpgrade nodejs-develUpgrade httpd-filesystemUpgrade mod_ldapUpgrade nodejs-nodemonUpgrade npmUpgrade mod_ldap-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade mod_md-debuginfoUpgrade nodejs-debuginfoUpgrade mod_sessionUpgrade mod_http2Upgrade nodejs-docsUpgrade mod_sslUpgrade mod_proxy_htmlUpgrade mod_md | Sep 27, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade apache2 | Aug 28, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade nodeUpgrade node8Upgrade apache24 | Aug 21, 2019 | Aug 21, 2019 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Sep 9, 2019 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade httpd-manualUpgrade httpdUpgrade mod_sslUpgrade mod_sessionUpgrade httpd-filesystemUpgrade httpd-toolsUpgrade httpd-devel | Feb 26, 2020 | Aug 13, 2019 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.5.1 or later | Nov 5, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Oct 14, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade web/server/apache-24 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade httpd-develUpgrade httpd-manualUpgrade npmUpgrade mod_sessionUpgrade httpd-toolsUpgrade httpdUpgrade nodejs-develUpgrade nodejsUpgrade httpd-filesystemUpgrade mod_proxy_htmlUpgrade mod_ldapUpgrade mod_mdUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade mod_http2Upgrade mod_sslUpgrade nodejs-nodemon | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade httpd-tools-debuginfoUpgrade httpd-manualUpgrade mod_http2-debugsourceUpgrade mod_mdUpgrade httpd-debugsourceUpgrade nodejs-packagingUpgrade httpdUpgrade httpd-toolsUpgrade nodejs-docsUpgrade mod_http2-debuginfoUpgrade nodejs-debugsourceUpgrade nodejsUpgrade httpd-develUpgrade nodejs-devel-debuginfoUpgrade mod_ssl-debuginfoUpgrade mod_sessionUpgrade nodejs-develUpgrade mod_proxy_htmlUpgrade mod_ldapUpgrade httpd-debuginfoUpgrade npmUpgrade httpd-filesystemUpgrade nodejs-debuginfoUpgrade mod_http2Upgrade mod_md-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_sslUpgrade mod_session-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade nodejs-nodemon | Sep 25, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-multipressUpgrade npm8Upgrade mozilla-nsprUpgrade firefox-gtk3-dataUpgrade apache2Upgrade mozilla-nspr-develUpgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade mozilla-nspr-32bitUpgrade npm12Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs10-develUpgrade MozillaFirefox-translations-commonUpgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs12-docsUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade apache2-workerUpgrade apache2-docUpgrade firefox-libharfbuzz0Upgrade apache2-utilsUpgrade apache2-eventUpgrade firefox-gio-branding-upstreamUpgrade firefox-libgtk-3-0Upgrade firefox-libffi4Upgrade firefox-libffi7Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-atk-langUpgrade npm10Upgrade firefox-libcairo-gobject2Upgrade firefox-glib2-langUpgrade mozilla-nss-certs-32bitUpgrade apache2-example-pagesUpgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefoxUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nssUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade nodejs12Upgrade nodejs8-docsUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-glib2-toolsUpgrade libfreebl3-32bitUpgrade apache2-preforkUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libpango-1_0-0Upgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-develUpgrade nodejs8Upgrade nodejs10Upgrade libfreebl3Upgrade firefox-libcairo2Upgrade libsoftokn3Upgrade apache2-develUpgrade firefox-gtk3-toolsUpgrade nodejs8-develUpgrade nodejs12-develUpgrade MozillaFirefox-branding-SLED | Sep 3, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade apache2Upgrade apache2-bin | Aug 30, 2019 | Aug 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub