Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-filesystemUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nodejs-nodemonUpgrade nginx-mod-mailUpgrade nginx | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nghttp2Upgrade nodejs | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade mod_http2-debuginfoUpgrade libnghttp2Upgrade nghttp2Upgrade libnghttp2-develUpgrade mod_http2Upgrade nghttp2-debuginfo | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nghttp2Upgrade nginx | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nodejs-nodemonUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nodejs-docsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debugsourceUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade npmUpgrade nghttp2-debuginfoUpgrade nginx-debuginfoUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nodejs-debugsourceUpgrade nginx-all-modulesUpgrade nghttp2-debugsourceUpgrade nginx-mod-mail-debuginfoUpgrade nodejs-packagingUpgrade nginx-mod-mailUpgrade libnghttp2Upgrade nodejsUpgrade nodejs-devel-debuginfoUpgrade nginxUpgrade libnghttp2-debuginfoUpgrade nginx-filesystemUpgrade nodejs-develUpgrade nginx-mod-http-xslt-filter-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nodejsUpgrade nginxUpgrade nghttp2 | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nodeUpgrade node10Upgrade libnghttp2Upgrade node8Upgrade nghttp2Upgrade nginx-develUpgrade nginx | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-all-modulesUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filter | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.16.1Upgrade to nginx version 1.17.3 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade olcnectlUpgrade nginx-all-modulesUpgrade olcne-nginxUpgrade nodejs-develUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nodejsUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade olcne-utilsUpgrade olcne-agentUpgrade nodejs-docsUpgrade olcne-istio-chartUpgrade libnghttp2-develUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade olcne-api-serverUpgrade nghttp2Upgrade npmUpgrade nginx-filesystemUpgrade nodejs-nodemonUpgrade olcne-prometheus-chartUpgrade libnghttp2 | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginxUpgrade nghttp2Upgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade npmUpgrade nodejsUpgrade nghttp2-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nghttp2-debugsourceUpgrade libnghttp2-debuginfoUpgrade nginx-filesystemUpgrade nodejs-debuginfoUpgrade nodejs-packagingUpgrade nginx-all-modulesUpgrade libnghttp2-develUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nodejs-docsUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nodejs-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nodejs-develUpgrade nginx-mod-streamUpgrade nginx-mod-http-perlUpgrade nginx-debugsourceUpgrade libnghttp2Upgrade nginx-debuginfoUpgrade nodejs-nodemon | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-mailUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginxUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfo | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade npm8Upgrade mozilla-nss-32bitUpgrade firefox-libffi7Upgrade nodejs10Upgrade nginxUpgrade firefox-gdk-pixbuf-thumbnailerUpgrade nodejs10-develUpgrade firefox-gdk-pixbuf-query-loadersUpgrade libfirefox-gmodule-2_0-0Upgrade python3-nghttp2Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libcairo-gobject2Upgrade firefox-libffi4Upgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs8-develUpgrade mozilla-nsprUpgrade nodejs12-develUpgrade nodejs8Upgrade libnghttp2_asio-develUpgrade mozilla-nss-certsUpgrade libfreebl3Upgrade firefox-atk-langUpgrade npm12Upgrade nodejs8-docsUpgrade libnghttp2-14Upgrade libfirefox-glib-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade firefox-libpango-1_0-0Upgrade libfirefox-gio-2_0-0Upgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-glib2-toolsUpgrade firefox-gdk-pixbuf-langUpgrade firefox-gtk3-branding-upstreamUpgrade MozillaFirefoxUpgrade npm10Upgrade firefox-gio-branding-upstreamUpgrade firefox-gtk3-immodule-thaiUpgrade nodejs10-docsUpgrade firefox-libgtk-3-0Upgrade libfirefox-gthread-2_0-0Upgrade mozilla-nssUpgrade firefox-glib2-langUpgrade libnghttp2_asio1-32bitUpgrade mozilla-nss-develUpgrade nginx-sourceUpgrade nodejs12-docsUpgrade firefox-gtk3-langUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodule-amharicUpgrade libnghttp2-develUpgrade mozilla-nspr-develUpgrade firefox-gtk3-immodule-ximUpgrade nodejs12Upgrade MozillaFirefox-translations-otherUpgrade libnghttp2_asio1Upgrade firefox-gtk3-immodule-multipressUpgrade firefox-gtk3-dataUpgrade firefox-libharfbuzz0Upgrade firefox-libcairo2Upgrade libsoftokn3-32bitUpgrade libnghttp2-14-32bitUpgrade firefox-gtk3-toolsUpgrade mozilla-nspr-32bitUpgrade MozillaFirefox-translations-commonUpgrade nghttp2Upgrade MozillaFirefox-branding-SLEDUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade vim-plugin-nginxUpgrade firefox-gtk3-immodules-tigrigna | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nginx-coreUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-serverUpgrade nginx-lightUpgrade nginx-extrasUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade nginx-commonUpgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2Upgrade nghttp2-clientUpgrade nghttp2-proxyUpgrade libnghttp2-14Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nginx-full | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub