In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nghttp2Upgrade libnghttp2-develUpgrade nodejs-nodemonUpgrade nodejs-packagingUpgrade libnghttp2 | May 4, 2022 | Jun 3, 2020 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejs-currentUpgrade nodejs | Mar 26, 2024 | Jun 3, 2020 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2-develUpgrade nghttp2Upgrade nghttp2-debuginfoUpgrade libnghttp2 | Jul 2, 2020 | Jun 3, 2020 |
| Amazon_linux | — | Upgrade nghttp2 | Jul 30, 2020 | Jun 3, 2020 |
| Centos_linux | — | Upgrade nghttp2-debuginfoUpgrade libnghttp2-debuginfoUpgrade libnghttp2Upgrade nodejs-debugsourceUpgrade nghttp2-debugsourceUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade nodejs-develUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade npmUpgrade nodejsUpgrade nodejs-docs | Jun 26, 2020 | Jun 3, 2020 |
| Debian | — | Upgrade nodejsUpgrade nghttp2 | Jun 8, 2020 | Jun 3, 2020 |
| Freebsd | — | Upgrade libnghttp2Upgrade node12Upgrade nghttp2Upgrade node10Upgrade node | Jun 12, 2020 | Jun 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libnghttp2 | Jul 31, 2020 | Jun 3, 2020 |
| Oracle Mysql | — | Upgrade to the latest version of MySQL | Apr 8, 2021 | Jun 3, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-10 to version 10.22.0-11.4.26.0.1.75.3 on Solaris 11.4Upgrade runtime/nodejs/nodejs-12 to version 12.18.3-11.4.26.0.1.75.3 on Solaris 11.4Upgrade runtime/nodejs to version 12.18.3-11.4.26.0.1.75.3 on Solaris 11.4Upgrade library/nghttp2 to version 1.41.0-11.4.25.0.1.75.2 on Solaris 11.4 | Jan 19, 2021 | Jun 3, 2020 |
| Oracle_linux | — | Upgrade istioUpgrade olcne-nginxUpgrade olcne-prometheus-chartUpgrade libnghttp2Upgrade istio-sidecar-injectorUpgrade libnghttp2-develUpgrade npmUpgrade olcnectlUpgrade nghttp2Upgrade istio-citadelUpgrade kata-runtimeUpgrade nodejs-nodemonUpgrade istio-galleyUpgrade kernel-uek-containerUpgrade istio-pilot-discoveryUpgrade olcne-agentUpgrade istio-proxy-initUpgrade kubeletUpgrade istio-node-agentUpgrade nodejs-full-i18nUpgrade istio-istioctlUpgrade nodejs-docsUpgrade olcne-utilsUpgrade nodejsUpgrade istio-pilot-agentUpgrade olcne-istio-chartUpgrade kubeadmUpgrade kata-imageUpgrade nodejs-packagingUpgrade kubectlUpgrade istio-mixsUpgrade nodejs-develUpgrade olcne-api-serverUpgrade kataUpgrade istio-mixc | Jul 22, 2020 | Jun 2, 2020 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade libnghttp2-debuginfoUpgrade nghttp2Upgrade nghttp2-debuginfoUpgrade npmUpgrade libnghttp2-develUpgrade nodejs-nodemonUpgrade nodejs-debugsourceUpgrade nghttp2-debugsourceUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejs-docsUpgrade libnghttp2 | Jun 26, 2020 | Jun 3, 2020 |
| Rocky_linux | — | Upgrade nghttp2Upgrade libnghttp2-develUpgrade nghttp2-debugsourceUpgrade libnghttp2Upgrade nghttp2-debuginfoUpgrade libnghttp2-debuginfo | Mar 12, 2024 | Jun 3, 2020 |
| Suse | — | Upgrade nodejs10Upgrade python3-nghttp2Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade libnghttp2-14-32bitUpgrade nodejs12-develUpgrade libnghttp2-14Upgrade npm8Upgrade nodejs8Upgrade nodejs8-develUpgrade npm12Upgrade libnghttp2_asio-develUpgrade nodejs10-docsUpgrade nodejs14-develUpgrade nodejs8-docsUpgrade nodejs12Upgrade npm10Upgrade nghttp2Upgrade nodejs10-develUpgrade libnghttp2_asio1Upgrade nodejs14Upgrade libnghttp2-develUpgrade libnghttp2_asio1-32bitUpgrade npm14 | Jun 10, 2020 | Jun 3, 2020 |
| Ubuntu | — | Upgrade nghttp2-serverUpgrade nghttp2-clientUpgrade libnghttp2-devUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-server (Ubuntu Pro)Upgrade libnghttp2-14Upgrade libnghttp2-dev (Ubuntu Pro) | Jun 7, 2023 | Jun 3, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub