Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
2019-08-13T21:15:12.647
2025-01-14T19:29:55.853
Modified
CVSSv3.1: 7.5 (HIGH)
AV:N/AC:L/Au:N/C:N/I:N/A:C
10.0
6.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | apple | swiftnio | ≤ 1.4.0 | Yes |
| Operating System | apple | mac_os_x | ≥ 10.12 | No |
| Operating System | canonical | ubuntu_linux | ≥ 14.04 | No |
| Application | apache | http_server | < 2.4.40 | Yes |
| Application | apache | traffic_server | ≤ 6.2.3 | Yes |
| Application | apache | traffic_server | ≤ 7.1.6 | Yes |
| Application | apache | traffic_server | ≤ 8.0.3 | Yes |
| Operating System | canonical | ubuntu_linux | 16.04 | Yes |
| Operating System | canonical | ubuntu_linux | 18.04 | Yes |
| Operating System | canonical | ubuntu_linux | 19.04 | Yes |
| Operating System | debian | debian_linux | 9.0 | Yes |
| Operating System | debian | debian_linux | 10.0 | Yes |
| Application | synology | skynas | - | Yes |
| Operating System | synology | diskstation_manager | 6.2 | Yes |
| Operating System | synology | vs960hd_firmware | - | Yes |
| Hardware | synology | vs960hd | - | No |
| Operating System | fedoraproject | fedora | 29 | Yes |
| Operating System | fedoraproject | fedora | 30 | Yes |
| Operating System | opensuse | leap | 15.0 | Yes |
| Operating System | opensuse | leap | 15.1 | Yes |
| Application | redhat | jboss_core_services | 1.0 | Yes |
| Application | redhat | jboss_enterprise_application_platform | 7.2.0 | Yes |
| Application | redhat | jboss_enterprise_application_platform | 7.3.0 | Yes |
| Application | redhat | openshift_service_mesh | 1.0 | Yes |
| Application | redhat | quay | 3.0.0 | Yes |
| Application | redhat | software_collections | 1.0 | Yes |
| Operating System | redhat | enterprise_linux | 8.0 | Yes |
| Application | oracle | communications_element_manager | 8.0.0 | Yes |
| Application | oracle | communications_element_manager | 8.1.0 | Yes |
| Application | oracle | communications_element_manager | 8.1.1 | Yes |
| Application | oracle | communications_element_manager | 8.2.0 | Yes |
| Application | oracle | graalvm | 19.2.0 | Yes |
| Application | oracle | instantis_enterprisetrack | ≤ 17.3 | Yes |
| Application | oracle | retail_xstore_point_of_service | 7.1 | Yes |
| Application | mcafee | web_gateway | < 7.7.2.24 | Yes |
| Application | mcafee | web_gateway | < 7.8.2.13 | Yes |
| Application | mcafee | web_gateway | < 8.2.0 | Yes |
| Application | netapp | clustered_data_ontap | - | Yes |
| Application | nodejs | node.js | ≤ 8.8.1 | Yes |
| Application | nodejs | node.js | < 8.16.1 | Yes |
| Application | nodejs | node.js | ≤ 10.12.0 | Yes |
| Application | nodejs | node.js | < 10.16.3 | Yes |
| Application | nodejs | node.js | < 12.8.1 | Yes |