Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nginx-filesystemUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nodejs-packagingUpgrade nginx-all-modulesUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-nodemon | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nghttp2Upgrade nodejsUpgrade nginx | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2Upgrade mod_http2-debuginfoUpgrade nghttp2-debuginfoUpgrade libnghttp2-develUpgrade nghttp2Upgrade mod_http2 | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-debugsourceUpgrade npmUpgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filterUpgrade nginx-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-docsUpgrade nodejs-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nghttp2-debugsourceUpgrade nodejs-nodemonUpgrade nghttp2-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nodejs-devel-debuginfoUpgrade nodejsUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2-debuginfoUpgrade nginxUpgrade nginx-mod-mailUpgrade nodejs-develUpgrade nodejs-packagingUpgrade libnghttp2 | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nghttp2Upgrade nginxUpgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginxUpgrade node8Upgrade nghttp2Upgrade nginx-develUpgrade libnghttp2Upgrade nodeUpgrade node10 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginxUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perl | Sep 30, 2019 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade libnghttp2Upgrade olcne-istio-chartUpgrade libnghttp2-develUpgrade nodejs-docsUpgrade nghttp2Upgrade nodejs-nodemonUpgrade nginx-filesystemUpgrade olcne-api-serverUpgrade olcne-prometheus-chartUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade npmUpgrade olcnectlUpgrade nginx-mod-http-perlUpgrade olcne-nginxUpgrade nginx-mod-mailUpgrade nodejsUpgrade olcne-agentUpgrade nodejs-packagingUpgrade olcne-utilsUpgrade nginx-mod-http-image-filterUpgrade nodejs-develUpgrade nginxUpgrade nginx-all-modules | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-all-modulesUpgrade nghttp2Upgrade nodejs-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade libnghttp2-develUpgrade nginx-filesystemUpgrade nginx-mod-mail-debuginfoUpgrade nodejsUpgrade nghttp2-debuginfoUpgrade nodejs-packagingUpgrade npmUpgrade nginxUpgrade nghttp2-debugsourceUpgrade libnghttp2-debuginfoUpgrade nginx-debugsourceUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nodejs-develUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade libnghttp2Upgrade nodejs-nodemon | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-mod-mail-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nginxUpgrade nodejs8-develUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gio-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfirefox-gmodule-2_0-0Upgrade libfreebl3-32bitUpgrade firefox-gdk-pixbuf-langUpgrade npm12Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade mozillafirefoxUpgrade firefox-libcairo-gobject2Upgrade libnghttp2-14Upgrade nodejs10Upgrade firefox-glib2-toolsUpgrade mozilla-nss-32bitUpgrade python3-nghttp2Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nsprUpgrade firefox-libffi7Upgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gio-branding-upstreamUpgrade npm8Upgrade nodejs12-develUpgrade nodejs10-develUpgrade firefox-libpango-1_0-0Upgrade libnghttp2_asio-develUpgrade nodejs8Upgrade firefox-gtk3-immodule-thaiUpgrade nodejs8-docsUpgrade mozilla-nss-certsUpgrade libfreebl3Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-atk-langUpgrade firefox-libffi4Upgrade npm10Upgrade nodejs10-docsUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libgtk-3-0Upgrade firefox-glib2-langUpgrade firefox-gtk3-immodules-tigrignaUpgrade mozilla-nss-develUpgrade libsoftokn3-32bitUpgrade mozilla-nss-toolsUpgrade nginx-sourceUpgrade mozilla-nssUpgrade firefox-libharfbuzz0Upgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-langUpgrade libnghttp2_asio1-32bitUpgrade mozillafirefox-branding-sledUpgrade nodejs12-docsUpgrade mozilla-nspr-32bitUpgrade vim-plugin-nginxUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-toolsUpgrade libnghttp2_asio1Upgrade firefox-libcairo2Upgrade libnghttp2-14-32bitUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-ximUpgrade libnghttp2-develUpgrade firefox-gtk3-immodule-amharicUpgrade libsoftokn3Upgrade mozilla-nspr-develUpgrade mozillafirefox-translations-otherUpgrade nodejs12Upgrade firefox-libatk-1_0-0Upgrade firefox-libgdk_pixbuf-2_0-0Upgrade nghttp2 | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2-client (Ubuntu Pro)Upgrade nginx-coreUpgrade nginx-lightUpgrade nghttp2-serverUpgrade nghttp2Upgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2-clientUpgrade libnghttp2-14Upgrade nginx-fullUpgrade nginx-extrasUpgrade nghttp2 (Ubuntu Pro)Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nginx-commonUpgrade nghttp2-proxy (Ubuntu Pro) | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub