Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nodejsUpgrade apache2 | Aug 22, 2024 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2Upgrade mod_http2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade httpd24 | Oct 26, 2019 | Aug 13, 2019 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Aug 16, 2019 | Aug 13, 2019 |
| Centos_linux | — | Upgrade mod_ssl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade mod_http2-debugsourceUpgrade httpd-tools-debuginfoUpgrade httpd-toolsUpgrade mod_http2-debuginfoUpgrade nodejsUpgrade httpd-debugsourceUpgrade httpd-develUpgrade httpdUpgrade nodejs-packagingUpgrade httpd-manualUpgrade nodejs-debugsourceUpgrade httpd-debuginfoUpgrade mod_proxy_htmlUpgrade httpd-filesystemUpgrade nodejs-nodemonUpgrade mod_http2Upgrade nodejs-docsUpgrade mod_ldapUpgrade mod_ldap-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade mod_sessionUpgrade nodejs-develUpgrade mod_session-debuginfoUpgrade nodejs-debuginfoUpgrade npmUpgrade mod_md-debuginfoUpgrade mod_sslUpgrade mod_md | Sep 27, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade apache2 | Aug 28, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nodeUpgrade apache24Upgrade node10Upgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Sep 9, 2019 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade httpd-develUpgrade httpd-filesystemUpgrade httpd-toolsUpgrade httpd-manualUpgrade mod_sslUpgrade mod_sessionUpgrade httpd | Feb 26, 2020 | Aug 13, 2019 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.5.1 or later | Nov 5, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade web/server/apache-24/module/apache-ldap to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade mod_ldapUpgrade httpd-filesystemUpgrade mod_proxy_htmlUpgrade mod_http2Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade mod_mdUpgrade mod_sslUpgrade nodejs-nodemonUpgrade httpd-manualUpgrade npmUpgrade mod_sessionUpgrade httpd-toolsUpgrade httpdUpgrade nodejs-develUpgrade nodejsUpgrade httpd-devel | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade mod_proxy_htmlUpgrade httpd-debuginfoUpgrade mod_ldapUpgrade mod_md-debuginfoUpgrade mod_http2Upgrade npmUpgrade mod_session-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade mod_sslUpgrade nodejs-develUpgrade httpd-filesystemUpgrade mod_ldap-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade mod_sessionUpgrade nodejs-packagingUpgrade httpd-toolsUpgrade mod_mdUpgrade nodejs-docsUpgrade nodejs-debugsourceUpgrade nodejsUpgrade httpd-manualUpgrade httpd-tools-debuginfoUpgrade httpdUpgrade nodejs-devel-debuginfoUpgrade httpd-develUpgrade mod_http2-debugsourceUpgrade httpd-debugsourceUpgrade mod_ssl-debuginfoUpgrade mod_http2-debuginfo | Sep 25, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-glib2-toolsUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfreebl3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade nodejs8-docsUpgrade MozillaFirefoxUpgrade apache2-preforkUpgrade firefox-gtk3-branding-upstreamUpgrade nodejs12Upgrade mozilla-nss-toolsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nssUpgrade mozilla-nss-certsUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nss-32bitUpgrade nodejs10Upgrade nodejs8Upgrade mozilla-nss-certs-32bitUpgrade nodejs8-develUpgrade libsoftokn3Upgrade nodejs12-develUpgrade firefox-libcairo2Upgrade mozilla-nss-develUpgrade MozillaFirefox-branding-SLEDUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-toolsUpgrade apache2-example-pagesUpgrade firefox-libpango-1_0-0Upgrade apache2-develUpgrade firefox-gtk3-immodule-ximUpgrade libfreebl3Upgrade firefox-libffi4Upgrade apache2-workerUpgrade nodejs10-docsUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade nodejs10-develUpgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nsprUpgrade npm10Upgrade nodejs12-docsUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-thaiUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gdk-pixbuf-langUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade MozillaFirefox-translations-otherUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-multipressUpgrade npm12Upgrade npm8Upgrade apache2-utilsUpgrade apache2-eventUpgrade apache2-docUpgrade firefox-libgtk-3-0Upgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gio-branding-upstreamUpgrade firefox-glib2-langUpgrade mozilla-nspr-develUpgrade libsoftokn3-32bitUpgrade firefox-libharfbuzz0Upgrade apache2Upgrade firefox-atk-langUpgrade firefox-libffi7Upgrade firefox-libcairo-gobject2 | Sep 3, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade apache2-binUpgrade apache2 | Aug 30, 2019 | Aug 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub