Description
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nghttp2 | 1.39.2-1 | — |
| Debian 14 | nginx | 1.14.2-3 | — |
| Debian 14 | nodejs | 10.16.3~dfsg-1 | — |
| Debian 13 | nghttp2 | 1.39.2-1 | — |
| Debian 13 | nginx | 1.14.2-3 | — |
| Debian 13 | nodejs | 10.16.3~dfsg-1 | — |
| Debian 12 | nghttp2 | 1.39.2-1 | — |
| Debian 12 | nginx | 1.14.2-3 | — |
| Debian 12 | nodejs | 10.16.3~dfsg-1 | — |
| Debian 10 | nghttp2 | 1.36.0-2+deb10u1 | DSA-4511-1 |
| Debian 10 | nginx | 1.14.2-2+deb10u1 | DSA-4505-1 |
| Debian 10 | nodejs | 10.19.0~dfsg1-1 | DSA-4669-1 |
| Debian 9 | nghttp2 | 1.18.1-1+deb9u1 | DSA-4511-1 |
| Debian 9 | nginx | 1.10.3-1+deb9u3 | DSA-4505-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | nghttp2 | 1.43.0-1ubuntu0.2 | USN-6754-1 |
| Ubuntu 20.04 LTS | nghttp2 | 1.40.0-1ubuntu0.3 | USN-6754-1 |
| Ubuntu 18.04 LTS | nginx | 1.14.0-0ubuntu1.4 | USN-4099-1 |
| Ubuntu 16.04 LTS | nginx | 1.10.3-0ubuntu0.16.04.4 | USN-4099-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | nghttp2 | 1.30.0-1ubuntu1+esm2 | USN-6754-1 |
| Ubuntu Pro 18.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 16.04 LTS | nghttp2 | 1.7.1-1ubuntu0.1~esm2 | USN-6754-1 |
| Ubuntu Pro 16.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nodejs | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nghttp2 +2 | 1.33.0-1.el8_0.1 | RHSA-2019:2692 |
| RHEL 8 | nginx +7 | 1:1.14.1-9.module+el8.0.0+4108+af250afe | RHSA-2019:2799 |
| RHEL 8 | nodejs +2 | 1:10.16.3-2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2019:2925 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2019:2925 |
| RHEL 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 3 | httpd24-httpd +5 | 2.4.34-8.el6.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-mod_md | 2.4.34-8.el7.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-mod_ssl +1 | 1:2.4.34-8.el6.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-nghttp2 +2 | 1.7.1-7.el6.1 | RHSA-2019:2949 |
| RHEL 3 | rh-nginx110-nginx +5 | 1:1.10.2-9.el6.1 | RHSA-2019:2745 |
| RHEL 3 | rh-nginx112-nginx +5 | 1:1.12.1-3.el7.1 | RHSA-2019:2746 |
| RHEL 3 | rh-nginx114-nginx +5 | 1:1.14.1-1.el7.1 | RHSA-2019:2775 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8 +2 | 3.0-5.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.1-2.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.1.2.el7 | RHSA-2019:2955 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | kiali | v1.0.6.redhat1-1.el7 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh +10 | 1.0.1-8.el8 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-21.el8 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.7.2-22.el8 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh-proxy | 1.0.1-7.el8 | RHSA-2019:3041 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.10-1.redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-byte-buddy | 1.9.11-1.redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-5.SP3_redhat_00003.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.17-2.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.13-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.18-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-msc | 1.4.11-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.16-2.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-6.Final_redhat_00006.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-2.SP1_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-6.Final_redhat_00005.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-20.SP12_redhat_00009.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-7.SP7_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.26-2.SP3_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.5-4.GA_redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.5-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.17-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.5-4.GA_redhat_00002.1.el7eap | RHSA-2019:4019 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +1 | 1.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl-linux-x86_64 | 1.0.8-5.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.5-1.redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr +1 | 1.6.3-63.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr-util +8 | 1.6.1-48.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-brotli +1 | 1.0.6-7.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 7.64.1-14.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-jansson +1 | 2.11-20.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.12-9.Final_redhat_2.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +2 | 1.2.46-22.redhat_1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 2.4.37-33.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.2-16.GA.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.39.2-1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1-25.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nginx +7 | 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma | ALSA-2019:2799 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nginx | 1:1.14.1-9.module+el8.4.0+542+81547229 | RLSA-2019:2799 |
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nghttp2 | 1.39.2-3.3.1 | SUSE-SU-2019:2473-1 |
| SLES 15 SP1 | nginx | 1.14.2-6.3.1 | SUSE-SU-2019:2309-1 |
| SLES 15 SP1 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 SP1 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 15 | nghttp2 | 1.39.2-3.3.1 | SUSE-SU-2019:2473-1 |
| SLES 15 | nginx | 1.14.2-3.6.1 | SUSE-SU-2019:2559-1 |
| SLES 15 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 12 SP5 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP4 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP3 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2254-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
| SLES for SAP 12 SP5 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP4 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP3 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP2 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud Crowbar 9 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud Crowbar 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 9 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 7 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE HPE Helion OpenStack 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nghttp2 | 1.43.0-1.6 | openSUSE-SU-2024:11091-1 |
| openSUSE Tumbleweed | nginx | 1.21.3-1.4 | openSUSE-SU-2024:11092-1 |
| openSUSE Leap 15.1 | nghttp2 +1 | 1.39.2-lp151.3.3.1 | openSUSE-SU-2019:2232-1 |
| openSUSE Leap 15.1 | nginx | 1.14.2-lp151.4.3.1 | openSUSE-SU-2019:2120-1 |
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
| openSUSE Leap 15.0 | nghttp2 +1 | 1.39.2-lp150.2.3.1 | openSUSE-SU-2019:2234-1 |
| openSUSE Leap 15.0 | nginx | 1.14.2-lp150.2.11.1 | openSUSE-SU-2019:2264-1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.24 | nginx | 1.16.1-r0 | — |
| Alpine v3.24 | nodejs | 10.16.3-r0 | — |
| Alpine v3.23 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.23 | nginx | 1.16.1-r0 | — |
| Alpine v3.23 | nodejs | 10.16.3-r0 | — |
| Alpine v3.22 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.22 | nginx | 1.16.1-r0 | — |
| Alpine v3.22 | nodejs | 10.16.3-r0 | — |
| Alpine v3.21 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.21 | nginx | 1.16.1-r0 | — |
| Alpine v3.21 | nodejs | 10.16.3-r0 | — |
| Alpine v3.20 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.20 | nginx | 1.16.1-r0 | — |
| Alpine v3.20 | nodejs | 10.16.3-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.19 | nginx | 1.16.1-r0 | — |
| Alpine v3.19 | nodejs | 10.16.3-r0 | — |
| Alpine v3.18 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.18 | nginx | 1.16.1-r0 | — |
| Alpine v3.18 | nodejs | 10.16.3-r0 | — |
| Alpine v3.17 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.17 | nginx | 1.16.1-r0 | — |
| Alpine v3.17 | nodejs | 10.16.3-r0 | — |
| Alpine v3.16 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.16 | nginx | 1.16.1-r0 | — |
| Alpine v3.16 | nodejs | 10.16.3-r0 | — |
| Alpine v3.15 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.15 | nginx | 1.16.1-r0 | — |
| Alpine v3.15 | nodejs | 10.16.3-r0 | — |
| Alpine v3.14 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.14 | nginx | 1.16.1-r0 | — |
| Alpine v3.14 | nodejs | 10.16.3-r0 | — |
| Alpine v3.13 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.13 | nginx | 1.16.1-r0 | — |
| Alpine v3.13 | nodejs | 10.16.3-r0 | — |
| Alpine v3.12 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.12 | nginx | 1.16.1-r0 | — |
| Alpine v3.12 | nodejs | 10.16.3-r0 | — |
| Alpine v3.11 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.11 | nginx | 1.16.1-r0 | — |
| Alpine v3.11 | nodejs | 10.16.3-r0 | — |
| Alpine v3.10 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.10 | nginx | 1.16.1-r0 | — |
| Alpine v3.10 | nodejs | 10.16.3-r0 | — |
| Alpine v3.9 | nghttp2 | 1.35.1-r1 | — |
| Alpine v3.9 | nginx | 1.14.1-r2 | — |
| Alpine v3.9 | nodejs | 10.16.3-r0 | — |
| Alpine v3.8 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.8 | nginx | 1.14.1-r1 | — |
| Alpine v3.7 | nghttp2 | 1.39.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mod_http2 | 1.15.3-2.amzn2 | ALAS2-2019-1342 |
| Amazon Linux 2 | nghttp2 +2 | 1.39.2-1.amzn2 | ALAS2-2019-1298 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nghttp2 +2 | 1.33.0-1.el8_0.1 | ELSA-2019-2692 |
| Oracle Linux 8 | nginx +7 | 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e | ELSA-2019-2799 |
| Oracle Linux 8 | nodejs +2 | 1:10.14.1-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | npm | 1:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 7 | nginx +7 | 1:1.17.7-2.el7 | ELSA-2020-5862, ELSA-2020-5859 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.6-1.el7 | ELSA-2020-5859 |
| Oracle Linux 7 | olcnectl +4 | 1.0.8-2.el7 | ELSA-2020-5862, ELSA-2020-5859 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
flyniu666/ingress-nginx-0.21-1.19.5 ★ 1 · Dec 22, 2020
based on nginx 1.19.5 to fix for CVE-2018-16843, CVE-2018-16844, CVE-2019-9511, CVE-2019-9513, and CVE-2019-9516
-
harley-ghostie/CVE-2019-9511_Priority-Churn-Data-Dribble ★ 0 · Apr 29, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- ALSA-2019:2925 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2019:2799 Important: nginx:1.14 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:3933 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:3932 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4020 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4018 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:3041 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.1 RPMs Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2955 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2946 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2949 Red Hat Security Advisory: httpd24-httpd and httpd24-nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2925 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2799 Red Hat Security Advisory: nginx:1.14 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2775 Red Hat Security Advisory: rh-nginx114-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2746 Red Hat Security Advisory: rh-nginx112-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2745 Red Hat Security Advisory: rh-nginx110-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2692 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-6754-1 nghttp2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4669-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4505-1 nginx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4511-1 nghttp2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4099-1 nginx vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2019:2799 Important: nginx:1.14 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2019:2925 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2019:2259-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2309-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2234-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2473-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2559-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2260-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0932-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2264-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2120-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2114-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2115-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2254-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2232-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11092-1 nginx-1.21.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11091-1 libnghttp2-14-1.43.0-1.6 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
- WID-SEC-2024-1050 nginx: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 7, 2024
- ELSA-2020-5862 Important: olcne nginx security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 28, 2020
- ELSA-2020-5859 Important: olcne nginx security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 24, 2020
- ALAS2-2019-1342 Important: mod_http2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 30, 2019
- ALAS2-2019-1298 Important: nghttp2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 9, 2019
- ELSA-2019-2925 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2019
References
- VU#605641 third-party-advisory
- USN-4099-1 vendor-advisory
- FEDORA-2019-befd924cfe vendor-advisory
- 20190822 [SECURITY] [DSA 4505-1] nginx security update mailing-list
- FEDORA-2019-81985a8858 vendor-advisory
- DSA-4505 vendor-advisory
- FEDORA-2019-8a437d5c2f vendor-advisory
- FEDORA-2019-4427fd65be vendor-advisory
- FEDORA-2019-63ba15cc83 vendor-advisory
- 20190902 [SECURITY] [DSA 4511-1] nghttp2 security update mailing-list
- DSA-4511 vendor-advisory
- FEDORA-2019-7a0b45fdc4 vendor-advisory
- RHSA-2019:2692 vendor-advisory
- openSUSE-SU-2019:2120 vendor-advisory
- openSUSE-SU-2019:2114 vendor-advisory
- openSUSE-SU-2019:2115 vendor-advisory
- RHSA-2019:2745 vendor-advisory
- RHSA-2019:2746 vendor-advisory
- RHSA-2019:2775 vendor-advisory
- RHSA-2019:2799 vendor-advisory
- RHSA-2019:2925 vendor-advisory
- RHSA-2019:2939 vendor-advisory
- RHSA-2019:2949 vendor-advisory
- openSUSE-SU-2019:2232 vendor-advisory
- openSUSE-SU-2019:2234 vendor-advisory
- RHSA-2019:2955 vendor-advisory
- RHSA-2019:2966 vendor-advisory
- openSUSE-SU-2019:2264 vendor-advisory
- RHSA-2019:3041 vendor-advisory
- RHSA-2019:3933 vendor-advisory
- RHSA-2019:3935 vendor-advisory
- RHSA-2019:3932 vendor-advisory
- RHSA-2019:4018 vendor-advisory
- RHSA-2019:4019 vendor-advisory
- RHSA-2019:4021 vendor-advisory
- RHSA-2019:4020 vendor-advisory
- DSA-4669 vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://www.oracle.com/security-alerts/cpujan2021.html