Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade apache2Upgrade nodejs | Aug 22, 2024 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade mod_http2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade httpd24 | Oct 26, 2019 | Aug 13, 2019 |
| Apache Httpd | — | Upgrade to the latest version of Apache HTTPD | Aug 16, 2019 | Aug 13, 2019 |
| Centos_linux | — | Upgrade httpd-toolsUpgrade httpd-manualUpgrade mod_http2-debugsourceUpgrade nodejsUpgrade nodejs-debugsourceUpgrade httpd-debuginfoUpgrade httpd-debugsourceUpgrade mod_http2-debuginfoUpgrade mod_ssl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade httpd-tools-debuginfoUpgrade httpd-develUpgrade nodejs-packagingUpgrade httpdUpgrade nodejs-debuginfoUpgrade mod_ldapUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade mod_mdUpgrade mod_proxy_htmlUpgrade mod_sslUpgrade nodejs-develUpgrade mod_http2Upgrade npmUpgrade mod_ldap-debuginfoUpgrade mod_proxy_html-debuginfoUpgrade mod_md-debuginfoUpgrade httpd-filesystemUpgrade mod_session-debuginfoUpgrade mod_session | Sep 27, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade apache2 | Aug 28, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade node10Upgrade nodeUpgrade apache24Upgrade node8 | Aug 21, 2019 | Aug 21, 2019 |
| Gentoo Linux | — | Upgrade www-servers/apache. | Sep 9, 2019 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade httpd-toolsUpgrade httpd-develUpgrade httpd-filesystemUpgrade httpdUpgrade mod_sessionUpgrade httpd-manualUpgrade mod_ssl | Feb 26, 2020 | Aug 13, 2019 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.5.1 or later | Nov 5, 2019 | Aug 13, 2019 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Jan 3, 2020 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-gss to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-lua to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ldap to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-ssl-fips-140 to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4Upgrade web/server/apache-24/module/apache-dbd to version 2.4.41-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade httpd-toolsUpgrade npmUpgrade mod_sessionUpgrade httpd-manualUpgrade httpd-develUpgrade httpdUpgrade nodejs-develUpgrade nodejsUpgrade mod_ldapUpgrade mod_sslUpgrade nodejs-nodemonUpgrade mod_proxy_htmlUpgrade mod_http2Upgrade nodejs-docsUpgrade mod_mdUpgrade nodejs-packagingUpgrade httpd-filesystem | Oct 5, 2022 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade httpdUpgrade mod_mdUpgrade mod_ssl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade httpd-debugsourceUpgrade httpd-develUpgrade mod_http2-debuginfoUpgrade httpd-tools-debuginfoUpgrade nodejsUpgrade nodejs-packagingUpgrade mod_http2-debugsourceUpgrade httpd-manualUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade httpd-toolsUpgrade httpd-debuginfoUpgrade nodejs-develUpgrade mod_sessionUpgrade mod_ldapUpgrade httpd-filesystemUpgrade nodejs-debuginfoUpgrade mod_ldap-debuginfoUpgrade mod_http2Upgrade mod_md-debuginfoUpgrade mod_session-debuginfoUpgrade nodejs-nodemonUpgrade npmUpgrade mod_sslUpgrade mod_proxy_html-debuginfoUpgrade mod_proxy_html | Sep 25, 2019 | Aug 13, 2019 |
| Rocky_linux | — | — | Aug 15, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-thaiUpgrade apache2-eventUpgrade MozillaFirefox-translations-otherUpgrade npm12Upgrade npm10Upgrade firefox-gtk3-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libgtk-3-0Upgrade libfirefox-gthread-2_0-0Upgrade nodejs10-develUpgrade mozilla-nsprUpgrade npm8Upgrade firefox-gdk-pixbuf-langUpgrade nodejs12-docsUpgrade apache2-utilsUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-inuktitutUpgrade apache2-docUpgrade firefox-libatk-1_0-0Upgrade apache2-workerUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-libffi7Upgrade libsoftokn3-32bitUpgrade firefox-atk-langUpgrade nodejs10-docsUpgrade firefox-libharfbuzz0Upgrade apache2Upgrade firefox-gtk3-dataUpgrade firefox-libcairo-gobject2Upgrade firefox-libffi4Upgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-immodule-vietnameseUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nspr-develUpgrade firefox-glib2-toolsUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-toolsUpgrade nodejs8-develUpgrade nodejs12Upgrade mozilla-nss-certs-32bitUpgrade apache2-develUpgrade libfreebl3Upgrade libsoftokn3Upgrade apache2-preforkUpgrade MozillaFirefoxUpgrade nodejs8Upgrade libfirefox-gio-2_0-0Upgrade apache2-example-pagesUpgrade nodejs8-docsUpgrade MozillaFirefox-branding-SLEDUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nssUpgrade mozilla-nss-certsUpgrade mozilla-nss-toolsUpgrade nodejs12-develUpgrade firefox-libpango-1_0-0Upgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-develUpgrade nodejs10Upgrade firefox-libcairo2Upgrade libfirefox-gobject-2_0-0Upgrade mozilla-nss-32bitUpgrade firefox-libgdk_pixbuf-2_0-0 | Sep 3, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade apache2-binUpgrade apache2 | Aug 30, 2019 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub