Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
AI analysis not yet available
Plain-English explanation, risk summary, and remediation steps will appear here once AI analysis is complete.
No Fix Known
No patch has been released yet. Apply workarounds or mitigations where available.
| Vendor | Product | Versions | Fixed In |
|---|---|---|---|
| apple | swiftnio | 1.0.0 - 1.4.0 | - |
| apache | http_server | 2.4.20 - 2.4.40 | - |
| apache | traffic_server | 6.0.0 - 6.2.3 |
Published
CVE disclosed publicly
Last Modified
Most recent update
Indexed to CVEInsight
Added to this platform
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
40
Affected Products
94
References
apple / swiftnio
| - |
| apache | traffic_server | 7.0.0 - 7.1.6 | - |
| apache | traffic_server | 8.0.0 - 8.0.3 | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| canonical | ubuntu_linux | - | - |
| debian | debian_linux | - | - |
| debian | debian_linux | - | - |
| synology | skynas | - | - |
| synology | diskstation_manager | - | - |
| synology | vs960hd_firmware | - | - |
| fedoraproject | fedora | - | - |
| fedoraproject | fedora | - | - |
| opensuse | leap | - | - |
| opensuse | leap | - | - |
| redhat | jboss_core_services | - | - |
| redhat | jboss_enterprise_application_platform | - | - |
| redhat | jboss_enterprise_application_platform | - | - |
| redhat | openshift_service_mesh | - | - |
| redhat | quay | - | - |
| redhat | software_collections | - | - |
| redhat | enterprise_linux | - | - |
| oracle | communications_element_manager | - | - |
| oracle | communications_element_manager | - | - |
| oracle | communications_element_manager | - | - |
| oracle | communications_element_manager | - | - |
| oracle | graalvm | - | - |
| oracle | instantis_enterprisetrack | 17.1 - 17.3 | - |
| oracle | retail_xstore_point_of_service | - | - |
| mcafee | web_gateway | 7.7.2.0 - 7.7.2.24 | - |
| mcafee | web_gateway | 7.8.2.0 - 7.8.2.13 | - |
| mcafee | web_gateway | 8.1.0 - 8.2.0 | - |
| netapp | clustered_data_ontap | - | - |
| nodejs | node.js | 8.0.0 - 8.8.1 | - |
| nodejs | node.js | 8.9.0 - 8.16.1 | - |
| nodejs | node.js | 10.0.0 - 10.12.0 | - |
| nodejs | node.js | 10.13.0 - 10.16.3 | - |
| nodejs | node.js | 12.0.0 - 12.8.1 | - |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability
Impact