In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVSS Details
- CVSS 3.1 Base Score: 3.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libnghttp2Upgrade nodejs-packagingUpgrade nodejs-nodemonUpgrade nghttp2Upgrade libnghttp2-devel | May 4, 2022 | Jun 3, 2020 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nodejs-current | Mar 26, 2024 | Jun 3, 2020 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2-devel | Jul 2, 2020 | Jun 3, 2020 |
| Amazon_linux | — | Upgrade nghttp2 | Jul 30, 2020 | Jun 3, 2020 |
| Centos_linux | — | Upgrade npmUpgrade nodejs-nodemonUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejsUpgrade nodejs-full-i18nUpgrade nodejs-packagingUpgrade nodejs-debuginfoUpgrade libnghttp2-debuginfoUpgrade nodejs-debugsourceUpgrade nghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade libnghttp2 | Jun 26, 2020 | Jun 3, 2020 |
| Debian | — | Upgrade nodejsUpgrade nghttp2 | Jun 8, 2020 | Jun 3, 2020 |
| Freebsd | — | Upgrade nodeUpgrade node10Upgrade libnghttp2Upgrade nghttp2Upgrade node12 | Jun 12, 2020 | Jun 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libnghttp2 | Jul 31, 2020 | Jun 3, 2020 |
| Oracle Mysql | — | Upgrade to the latest version of MySQL | Apr 8, 2021 | Jun 3, 2020 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-12 to version 12.18.3-11.4.26.0.1.75.3 on Solaris 11.4Upgrade runtime/nodejs/nodejs-10 to version 10.22.0-11.4.26.0.1.75.3 on Solaris 11.4Upgrade library/nghttp2 to version 1.41.0-11.4.25.0.1.75.2 on Solaris 11.4Upgrade runtime/nodejs to version 12.18.3-11.4.26.0.1.75.3 on Solaris 11.4 | Jan 19, 2021 | Jun 3, 2020 |
| Oracle_linux | — | Upgrade olcne-api-serverUpgrade kataUpgrade nodejs-docsUpgrade olcne-istio-chartUpgrade istio-node-agentUpgrade nodejs-full-i18nUpgrade nodejsUpgrade istio-mixsUpgrade olcne-utilsUpgrade kubectlUpgrade nodejs-develUpgrade kubeadmUpgrade kata-imageUpgrade istio-pilot-agentUpgrade istio-mixcUpgrade istio-istioctlUpgrade nodejs-packagingUpgrade npmUpgrade kubeletUpgrade istioUpgrade libnghttp2Upgrade libnghttp2-develUpgrade kernel-uek-containerUpgrade olcne-agentUpgrade istio-sidecar-injectorUpgrade istio-proxy-initUpgrade nodejs-nodemonUpgrade kata-runtimeUpgrade istio-citadelUpgrade olcne-prometheus-chartUpgrade olcne-nginxUpgrade istio-galleyUpgrade nghttp2Upgrade olcnectlUpgrade istio-pilot-discovery | Jul 22, 2020 | Jun 2, 2020 |
| Redhat_linux | — | Upgrade nodejs-debuginfoUpgrade libnghttp2-debuginfoUpgrade nghttp2-debuginfoUpgrade nghttp2Upgrade npmUpgrade nodejs-nodemonUpgrade libnghttp2-develUpgrade libnghttp2Upgrade nodejs-develUpgrade nodejsUpgrade nodejs-packagingUpgrade nodejs-docsUpgrade nodejs-full-i18nUpgrade nodejs-debugsourceUpgrade nghttp2-debugsource | Jun 26, 2020 | Jun 3, 2020 |
| Rocky_linux | — | Upgrade nghttp2-debuginfoUpgrade libnghttp2-debuginfoUpgrade libnghttp2Upgrade libnghttp2-develUpgrade nghttp2Upgrade nghttp2-debugsource | Mar 12, 2024 | Jun 3, 2020 |
| Suse | — | Upgrade nodejs12Upgrade nodejs10-docsUpgrade nodejs14-develUpgrade libnghttp2-develUpgrade nodejs14Upgrade nodejs8-docsUpgrade npm14Upgrade libnghttp2_asio1-32bitUpgrade libnghttp2_asio1Upgrade nodejs10-develUpgrade nghttp2Upgrade npm10Upgrade nodejs12-docsUpgrade nodejs14-docsUpgrade libnghttp2_asio-develUpgrade nodejs10Upgrade nodejs12-develUpgrade libnghttp2-14Upgrade npm12Upgrade npm8Upgrade libnghttp2-14-32bitUpgrade nodejs8-develUpgrade nodejs8Upgrade python3-nghttp2 | Jun 10, 2020 | Jun 3, 2020 |
| Ubuntu | — | Upgrade libnghttp2-devUpgrade nghttp2-clientUpgrade nghttp2-serverUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade libnghttp2-dev (Ubuntu Pro)Upgrade libnghttp2-14Upgrade nghttp2-proxyUpgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2 | Jun 7, 2023 | Jun 3, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jun 3, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub