Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| apple | swiftnio | 1.0.0 - 1.4.0 | - |
| apache | traffic_server | 6.0.0 - 6.2.3 | - |
| apache | traffic_server | 7.0.0 - 7.1.6 |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
36
Affected Products
94
References
apple / swiftnio
| - |
| apache | traffic_server | 8.0.0 - 8.0.3 | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| debian | debian_linux | - | - |
| debian | debian_linux | - | - |
| synology | skynas | - | - |
| synology | diskstation_manager | - | - |
| synology | vs960hd_firmware | - | - |
| fedoraproject | fedora | - | - |
| fedoraproject | fedora | - | - |
| opensuse | leap | - | - |
| opensuse | leap | - | - |
| redhat | jboss_core_services | - | - |
| redhat | jboss_enterprise_application_platform | - | - |
| redhat | jboss_enterprise_application_platform | - | - |
| redhat | openshift_service_mesh | - | - |
| redhat | quay | - | - |
| redhat | software_collections | - | - |
| redhat | enterprise_linux | - | - |
| oracle | graalvm | - | - |
| mcafee | web_gateway | 7.7.2.0 - 7.7.2.24 | - |
| mcafee | web_gateway | 7.8.2.0 - 7.8.2.13 | - |
| mcafee | web_gateway | 8.1.0 - 8.2.0 | - |
| f5 | nginx | 1.9.5 - 1.16.1 | - |
| f5 | nginx | 1.17.0 - 1.17.2 | - |
| oracle | enterprise_communications_broker | - | - |
| oracle | enterprise_communications_broker | - | - |
| nodejs | node.js | 8.0.0 - 8.8.1 | - |
| nodejs | node.js | 8.9.0 - 8.16.1 | - |
| nodejs | node.js | 10.0.0 - 10.12.0 | - |
| nodejs | node.js | 10.13.0 - 10.16.3 | - |
| nodejs | node.js | 12.0.0 - 12.8.1 | - |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability
Impact