Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade apache2Upgrade nodejs | Aug 22, 2024 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade mod_http2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade httpd24 | Oct 26, 2019 | Aug 13, 2019 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Aug 16, 2019 | Aug 13, 2019 |
| Centos_linux | — | Upgrade npmUpgrade mod_proxy_html-debuginfoUpgrade nodejs-debuginfoUpgrade httpd-filesystemUpgrade mod_sslUpgrade nodejs-docsUpgrade mod_proxy_htmlUpgrade mod_ldap-debuginfoUpgrade mod_session-debuginfoUpgrade mod_sessionUpgrade mod_ldapUpgrade nodejs-develUpgrade mod_mdUpgrade mod_md-debuginfoUpgrade nodejs-nodemonUpgrade mod_http2Upgrade mod_http2-debuginfoUpgrade httpd-debugsourceUpgrade mod_http2-debugsourceUpgrade httpd-develUpgrade nodejs-devel-debuginfoUpgrade mod_ssl-debuginfoUpgrade nodejs-debugsourceUpgrade httpd-toolsUpgrade httpdUpgrade httpd-tools-debuginfoUpgrade httpd-debuginfoUpgrade httpd-manualUpgrade nodejsUpgrade nodejs-packaging | Sep 27, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade apache2 | Aug 28, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade node8Upgrade apache24Upgrade node | Aug 21, 2019 | Aug 21, 2019 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Sep 9, 2019 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade httpd-filesystemUpgrade httpd-toolsUpgrade httpd-develUpgrade mod_sslUpgrade mod_sessionUpgrade httpd-manualUpgrade httpd | Feb 26, 2020 | Aug 13, 2019 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.5.1 or later | Nov 5, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-dbd to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade httpd-develUpgrade httpd-toolsUpgrade mod_sessionUpgrade httpd-manualUpgrade nodejsUpgrade npmUpgrade httpdUpgrade nodejs-develUpgrade nodejs-docsUpgrade mod_ldapUpgrade mod_http2Upgrade mod_sslUpgrade nodejs-packagingUpgrade mod_mdUpgrade nodejs-nodemonUpgrade httpd-filesystemUpgrade mod_proxy_html | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade mod_http2Upgrade mod_proxy_html-debuginfoUpgrade nodejs-nodemonUpgrade mod_ldapUpgrade httpd-debuginfoUpgrade httpd-filesystemUpgrade nodejs-debuginfoUpgrade mod_sslUpgrade mod_session-debuginfoUpgrade mod_md-debuginfoUpgrade npmUpgrade mod_ldap-debuginfoUpgrade mod_sessionUpgrade nodejs-develUpgrade mod_proxy_htmlUpgrade mod_http2-debuginfoUpgrade nodejs-devel-debuginfoUpgrade mod_mdUpgrade httpd-toolsUpgrade mod_ssl-debuginfoUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejs-packagingUpgrade httpd-debugsourceUpgrade mod_http2-debugsourceUpgrade httpd-tools-debuginfoUpgrade httpd-manualUpgrade httpdUpgrade nodejsUpgrade httpd-devel | Sep 25, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade apache2-eventUpgrade mozilla-nspr-32bitUpgrade apache2-docUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gio-branding-upstreamUpgrade firefox-glib2-langUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-thaiUpgrade nodejs10-develUpgrade npm12Upgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade MozillaFirefox-translations-otherUpgrade apache2-workerUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodules-tigrignaUpgrade MozillaFirefox-translations-commonUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-multipressUpgrade npm10Upgrade firefox-libcairo-gobject2Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libffi7Upgrade apache2-utilsUpgrade npm8Upgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nsprUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libffi4Upgrade firefox-libharfbuzz0Upgrade mozilla-nspr-develUpgrade nodejs12-docsUpgrade apache2Upgrade firefox-atk-langUpgrade nodejs10-docsUpgrade libsoftokn3-32bitUpgrade nodejs12-develUpgrade MozillaFirefox-branding-SLEDUpgrade nodejs12Upgrade apache2-develUpgrade libfirefox-gobject-2_0-0Upgrade libsoftokn3Upgrade libfreebl3Upgrade firefox-libcairo2Upgrade firefox-gtk3-immodule-ximUpgrade firefox-gtk3-toolsUpgrade nodejs8-develUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-glib-2_0-0Upgrade firefox-glib2-toolsUpgrade mozilla-nss-32bitUpgrade apache2-preforkUpgrade MozillaFirefoxUpgrade libfreebl3-32bitUpgrade mozilla-nss-certs-32bitUpgrade nodejs8-docsUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade mozilla-nssUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-develUpgrade nodejs8Upgrade apache2-example-pagesUpgrade nodejs10Upgrade libfirefox-gio-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gtk3-branding-upstream | Sep 3, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade apache2Upgrade apache2-bin | Aug 30, 2019 | Aug 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub