In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade libnghttp2Upgrade nghttp2Upgrade libnghttp2-devel | May 4, 2022 | Jun 3, 2020 |
| Alpine Linux | — | Upgrade nodejsUpgrade nodejs-currentUpgrade nghttp2 | Mar 26, 2024 | Jun 3, 2020 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade nghttp2Upgrade libnghttp2-devel | Jul 2, 2020 | Jun 3, 2020 |
| Amazon_linux | — | Upgrade nghttp2 | Jul 30, 2020 | Jun 3, 2020 |
| Centos_linux | — | Upgrade nghttp2-debugsourceUpgrade nodejs-debuginfoUpgrade libnghttp2-debuginfoUpgrade libnghttp2Upgrade nodejs-debugsourceUpgrade nghttp2-debuginfoUpgrade nodejs-packagingUpgrade nodejsUpgrade nodejs-full-i18nUpgrade npmUpgrade nodejs-nodemonUpgrade nodejs-develUpgrade nodejs-docs | Jun 26, 2020 | Jun 3, 2020 |
| Debian | — | Upgrade nodejsUpgrade nghttp2 | Jun 8, 2020 | Jun 3, 2020 |
| Freebsd | — | Upgrade libnghttp2Upgrade node12Upgrade nghttp2Upgrade nodeUpgrade node10 | Jun 12, 2020 | Jun 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libnghttp2 | Jul 31, 2020 | Jun 3, 2020 |
| Oracle Mysql | — | Upgrade to the latest version of MySQL | Apr 8, 2021 | Jun 3, 2020 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.41.0-11.4.25.0.1.75.2 on Solaris 11.4Upgrade runtime/nodejs to version 12.18.3-11.4.26.0.1.75.3 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.18.3-11.4.26.0.1.75.3 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.0-11.4.26.0.1.75.3 on Solaris 11.4 | Jan 19, 2021 | Jun 3, 2020 |
| Oracle_linux | — | Upgrade istio-galleyUpgrade istio-citadelUpgrade nodejs-nodemonUpgrade nghttp2Upgrade olcnectlUpgrade kata-runtimeUpgrade kernel-uek-containerUpgrade olcne-agentUpgrade olcne-nginxUpgrade olcne-prometheus-chartUpgrade npmUpgrade istio-pilot-discoveryUpgrade libnghttp2-develUpgrade istio-proxy-initUpgrade libnghttp2Upgrade kubeletUpgrade istio-sidecar-injectorUpgrade istioUpgrade nodejs-develUpgrade kataUpgrade olcne-api-serverUpgrade nodejs-full-i18nUpgrade kata-imageUpgrade istio-pilot-agentUpgrade istio-mixcUpgrade nodejs-packagingUpgrade istio-mixsUpgrade kubectlUpgrade kubeadmUpgrade olcne-utilsUpgrade olcne-istio-chartUpgrade nodejs-docsUpgrade istio-istioctlUpgrade istio-node-agentUpgrade nodejs | Jul 22, 2020 | Jun 2, 2020 |
| Redhat_linux | — | Upgrade nghttp2-debugsourceUpgrade nodejs-debugsourceUpgrade libnghttp2Upgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nghttp2Upgrade libnghttp2-develUpgrade nghttp2-debuginfoUpgrade npmUpgrade libnghttp2-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-nodemon | Jun 26, 2020 | Jun 3, 2020 |
| Rocky_linux | — | Upgrade nghttp2-debugsourceUpgrade nghttp2Upgrade libnghttp2-develUpgrade libnghttp2-debuginfoUpgrade libnghttp2Upgrade nghttp2-debuginfo | Mar 12, 2024 | Jun 3, 2020 |
| Suse | — | Upgrade nodejs10-docsUpgrade nghttp2Upgrade libnghttp2_asio1-32bitUpgrade libnghttp2-develUpgrade libnghttp2_asio1Upgrade nodejs10-develUpgrade nodejs12Upgrade npm10Upgrade npm14Upgrade nodejs14Upgrade nodejs14-develUpgrade nodejs8-docsUpgrade nodejs10Upgrade nodejs8Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade libnghttp2-14Upgrade nodejs12-develUpgrade npm12Upgrade libnghttp2_asio-develUpgrade python3-nghttp2Upgrade nodejs8-develUpgrade libnghttp2-14-32bitUpgrade npm8 | Jun 10, 2020 | Jun 3, 2020 |
| Ubuntu | — | Upgrade libnghttp2-devUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-serverUpgrade nghttp2-clientUpgrade nghttp2-server (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nghttp2-proxyUpgrade nghttp2 (Ubuntu Pro)Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade libnghttp2-dev (Ubuntu Pro) | Jun 7, 2023 | Jun 3, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub