Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-packagingUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-streamUpgrade nginx-filesystemUpgrade nginx-mod-mailUpgrade nodejs-nodemonUpgrade nginx-all-modulesUpgrade nginx | May 4, 2022 | Aug 13, 2019 |
| Alpine Linux | — | Upgrade nginxUpgrade nodejsUpgrade nghttp2 | Nov 8, 2019 | Aug 13, 2019 |
| Amazon Linux Ami 2 | — | Upgrade libnghttp2Upgrade mod_http2-debuginfoUpgrade mod_http2Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2-devel | Apr 27, 2020 | Aug 13, 2019 |
| Amazon_linux | — | Upgrade nginxUpgrade nghttp2 | Oct 4, 2019 | Aug 13, 2019 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Aug 13, 2019 |
| Centos_linux | — | Upgrade nginx-mod-mailUpgrade nodejs-develUpgrade nodejs-packagingUpgrade nginxUpgrade libnghttp2Upgrade libnghttp2-debuginfoUpgrade nodejs-devel-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-filesystemUpgrade nodejsUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perlUpgrade nodejs-docsUpgrade nginx-mod-stream-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs-nodemonUpgrade nodejs-debuginfoUpgrade npmUpgrade nghttp2-debugsourceUpgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-mail-debuginfoUpgrade nginx-debuginfoUpgrade nodejs-debugsourceUpgrade nginx-mod-http-image-filter-debuginfo | Sep 11, 2019 | Aug 13, 2019 |
| Debian | — | Upgrade nginxUpgrade nghttp2Upgrade nodejs | Aug 26, 2019 | Aug 13, 2019 |
| Freebsd | — | Upgrade nginx-develUpgrade nginxUpgrade nghttp2Upgrade node8Upgrade nodeUpgrade node10Upgrade libnghttp2 | Aug 21, 2019 | Aug 21, 2019 |
| Huawei Euleros 2_0_sp2 | — | Upgrade nginx | Nov 3, 2020 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp3 | — | Upgrade nginx | Jan 20, 2021 | Aug 13, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-perlUpgrade nginx-mod-streamUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginxUpgrade nginx-mod-mail | Sep 30, 2019 | Aug 13, 2019 |
| Mcafee Web Gateway | — | Upgrade to the latest version of Web Gateway | Sep 23, 2026 | Aug 13, 2019 |
| Msft | — | 2019-08 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4512508)2019-08 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1607 (KB4512517)2019-08 Cumulative Update for Microsoft Windows 10, version 1903 (KB4512508)2019-08 Cumulative Update for Microsoft Windows 10, version 1703 (KB4512507)2019-08 Cumulative Update for Microsoft Windows 10, version 1809 (KB4511553)2019-08 Cumulative Update for Microsoft Windows 10, version 1803 (KB4512501)2019-08 Cumulative Update for Microsoft Windows 10, version 1709 (KB4512516)2019-08 Cumulative Update for Microsoft Windows 10, version 1507 (KB4512497)2019-08 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB4512517) | Aug 13, 2019 | Aug 13, 2019 |
| Nginx | — | Upgrade to nginx version 1.17.3Upgrade to nginx version 1.16.1 | Aug 14, 2019 | Aug 13, 2019 |
| Oracle Solaris | — | Upgrade runtime/nodejs/nodejs-8 to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade runtime/nodejs to version 8.16.1-11.4.15.0.1.1.0 on Solaris 11.4Upgrade library/nghttp2 to version 1.39.2-11.4.14.0.1.1.0 on Solaris 11.4 | Oct 16, 2019 | Aug 13, 2019 |
| Oracle_linux | — | Upgrade nginx-all-modulesUpgrade olcne-nginxUpgrade nginx-mod-http-perlUpgrade nginx-mod-http-image-filterUpgrade nginxUpgrade olcnectlUpgrade nodejsUpgrade nginx-mod-mailUpgrade nodejs-packagingUpgrade olcne-agentUpgrade olcne-utilsUpgrade nodejs-develUpgrade nginx-filesystemUpgrade nodejs-docsUpgrade libnghttp2-develUpgrade nodejs-nodemonUpgrade nginx-mod-http-xslt-filterUpgrade olcne-api-serverUpgrade nghttp2Upgrade npmUpgrade nginx-mod-streamUpgrade olcne-istio-chartUpgrade olcne-prometheus-chartUpgrade libnghttp2 | Jul 21, 2020 | Aug 13, 2019 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Aug 13, 2019 |
| Red_hat Jboss_eap | — | — | Oct 27, 2020 | Aug 13, 2019 |
| Redhat_linux | — | Upgrade nginx-debuginfoUpgrade nginx-debugsourceUpgrade nodejs-nodemonUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-perl-debuginfoUpgrade nodejs-devel-debuginfoUpgrade libnghttp2Upgrade nodejs-develUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perlUpgrade nodejs-debugsourceUpgrade nodejs-docsUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mailUpgrade nodejs-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nghttp2Upgrade libnghttp2-develUpgrade nginx-all-modulesUpgrade nodejsUpgrade nghttp2-debuginfoUpgrade nginxUpgrade nodejs-packagingUpgrade nginx-mod-mail-debuginfoUpgrade nginx-filesystemUpgrade libnghttp2-debuginfoUpgrade nghttp2-debugsourceUpgrade npm | Sep 11, 2019 | Aug 13, 2019 |
| Rocky_linux | — | Upgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginx-mod-streamUpgrade nginx-debugsourceUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginxUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-perl | Mar 12, 2024 | Aug 13, 2019 |
| Suse | — | Upgrade nodejs10-develUpgrade nginxUpgrade python3-nghttp2Upgrade libfirefox-gio-2_0-0Upgrade npm8Upgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nsprUpgrade firefox-gtk3-branding-upstreamUpgrade libfirefox-gmodule-2_0-0Upgrade libnghttp2-14Upgrade nodejs8-develUpgrade nodejs8-docsUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-langUpgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-libcairo-gobject2Upgrade libfirefox-gobject-2_0-0Upgrade nodejs10Upgrade libfreebl3Upgrade nodejs10-docsUpgrade firefox-glib2-toolsUpgrade MozillaFirefoxUpgrade firefox-libffi4Upgrade firefox-gio-branding-upstreamUpgrade firefox-libpango-1_0-0Upgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-thaiUpgrade npm10Upgrade libfirefox-glib-2_0-0Upgrade firefox-atk-langUpgrade nodejs8Upgrade npm12Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libnghttp2_asio-develUpgrade firefox-libffi7Upgrade mozilla-nss-32bitUpgrade mozilla-nss-certsUpgrade nodejs12-develUpgrade firefox-gtk3-langUpgrade mozilla-nss-toolsUpgrade mozilla-nspr-develUpgrade firefox-libgtk-3-0Upgrade libsoftokn3-32bitUpgrade firefox-gtk3-dataUpgrade firefox-gtk3-immodule-multipressUpgrade firefox-libharfbuzz0Upgrade libfirefox-gthread-2_0-0Upgrade MozillaFirefox-translations-otherUpgrade vim-plugin-nginxUpgrade nodejs12-docsUpgrade libnghttp2-14-32bitUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3Upgrade MozillaFirefox-branding-SLEDUpgrade firefox-libatk-1_0-0Upgrade firefox-gtk3-immodules-tigrignaUpgrade nghttp2Upgrade nodejs12Upgrade firefox-libcairo2Upgrade libnghttp2_asio1Upgrade firefox-gtk3-immodule-ximUpgrade mozilla-nssUpgrade firefox-gtk3-toolsUpgrade mozilla-nss-develUpgrade mozilla-nspr-32bitUpgrade libnghttp2-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-glib2-langUpgrade nginx-sourceUpgrade libnghttp2_asio1-32bitUpgrade firefox-gtk3-immodule-amharic | Sep 11, 2019 | Aug 13, 2019 |
| Ubuntu | — | Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nghttp2-clientUpgrade nginx-extrasUpgrade nginx-fullUpgrade nginx-commonUpgrade nghttp2-proxy (Ubuntu Pro)Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2Upgrade libnghttp2-14Upgrade nginx-coreUpgrade nginx-lightUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2-server | Aug 16, 2019 | Aug 13, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 13, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub