Description
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nginx | 1.14.2-3 | — |
| Debian 13 | nginx | 1.14.2-3 | — |
| Debian 12 | nginx | 1.14.2-3 | — |
| Debian 10 | nginx | 1.14.2-2+deb10u1 | DSA-4505-1 |
| Debian 9 | nginx | 1.10.3-1+deb9u3 | DSA-4505-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | nginx | 1.14.0-0ubuntu1.4 | USN-4099-1 |
| Ubuntu 16.04 LTS | nginx | 1.10.3-0ubuntu0.16.04.4 | USN-4099-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nginx +7 | 1:1.14.1-9.module+el8.0.0+4108+af250afe | RHSA-2019:2799 |
| RHEL 8 | nodejs +2 | 1:10.16.3-2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2019:2925 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2019:2925 |
| RHEL 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 3 | rh-nginx110-nginx +5 | 1:1.10.2-9.el6.1 | RHSA-2019:2745 |
| RHEL 3 | rh-nginx112-nginx +5 | 1:1.12.1-3.el7.1 | RHSA-2019:2746 |
| RHEL 3 | rh-nginx114-nginx +5 | 1:1.14.1-1.el7.1 | RHSA-2019:2775 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8 +2 | 3.0-5.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.1-2.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.1.2.el7 | RHSA-2019:2955 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr +1 | 1.6.3-63.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr-util +8 | 1.6.1-48.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-brotli +1 | 1.0.6-7.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 7.64.1-14.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-jansson +1 | 2.11-20.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.12-9.Final_redhat_2.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +2 | 1.2.46-22.redhat_1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 2.4.37-33.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.2-16.GA.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.39.2-1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1-25.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nginx +7 | 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma | ALSA-2019:2799 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nginx | 1:1.14.1-9.module+el8.4.0+542+81547229 | RLSA-2019:2799 |
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nginx | 1.14.2-6.3.1 | SUSE-SU-2019:2309-1 |
| SLES 15 SP1 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 SP1 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 15 | nginx | 1.14.2-3.6.1 | SUSE-SU-2019:2559-1 |
| SLES 15 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 12 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2254-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nginx | 1.21.3-1.4 | openSUSE-SU-2024:11092-1 |
| openSUSE Leap 15.1 | nginx | 1.14.2-lp151.4.3.1 | openSUSE-SU-2019:2120-1 |
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
| openSUSE Leap 15.0 | nginx | 1.14.2-lp150.2.11.1 | openSUSE-SU-2019:2264-1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nginx | 1.16.1-r0 | — |
| Alpine v3.24 | nodejs | 10.16.3-r0 | — |
| Alpine v3.23 | nginx | 1.16.1-r0 | — |
| Alpine v3.23 | nodejs | 10.16.3-r0 | — |
| Alpine v3.22 | nginx | 1.16.1-r0 | — |
| Alpine v3.22 | nodejs | 10.16.3-r0 | — |
| Alpine v3.21 | nginx | 1.16.1-r0 | — |
| Alpine v3.21 | nodejs | 10.16.3-r0 | — |
| Alpine v3.20 | nginx | 1.16.1-r0 | — |
| Alpine v3.20 | nodejs | 10.16.3-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nginx | 1.16.1-r0 | — |
| Alpine v3.19 | nodejs | 10.16.3-r0 | — |
| Alpine v3.18 | nginx | 1.16.1-r0 | — |
| Alpine v3.18 | nodejs | 10.16.3-r0 | — |
| Alpine v3.17 | nginx | 1.16.1-r0 | — |
| Alpine v3.17 | nodejs | 10.16.3-r0 | — |
| Alpine v3.16 | nginx | 1.16.1-r0 | — |
| Alpine v3.16 | nodejs | 10.16.3-r0 | — |
| Alpine v3.15 | nginx | 1.16.1-r0 | — |
| Alpine v3.15 | nodejs | 10.16.3-r0 | — |
| Alpine v3.14 | nginx | 1.16.1-r0 | — |
| Alpine v3.14 | nodejs | 10.16.3-r0 | — |
| Alpine v3.13 | nginx | 1.16.1-r0 | — |
| Alpine v3.13 | nodejs | 10.16.3-r0 | — |
| Alpine v3.12 | nginx | 1.16.1-r0 | — |
| Alpine v3.12 | nodejs | 10.16.3-r0 | — |
| Alpine v3.11 | nginx | 1.16.1-r0 | — |
| Alpine v3.11 | nodejs | 10.16.3-r0 | — |
| Alpine v3.10 | nginx | 1.16.1-r0 | — |
| Alpine v3.10 | nodejs | 10.16.3-r0 | — |
| Alpine v3.9 | nginx | 1.14.1-r2 | — |
| Alpine v3.9 | nodejs | 10.16.3-r0 | — |
| Alpine v3.8 | nginx | 1.14.1-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mod_http2 | 1.15.3-2.amzn2 | ALAS2-2019-1342 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nginx +7 | 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e | ELSA-2019-2799 |
| Oracle Linux 8 | nodejs +2 | 1:10.14.1-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | npm | 1:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
Advisories 32
- ALSA-2019:2925 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2019:2799 Important: nginx:1.14 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:3933 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:3932 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:2955 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2946 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2925 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2799 Red Hat Security Advisory: nginx:1.14 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2775 Red Hat Security Advisory: rh-nginx114-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2746 Red Hat Security Advisory: rh-nginx112-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2745 Red Hat Security Advisory: rh-nginx110-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- DSA-4505-1 nginx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4099-1 nginx vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2019:2799 Important: nginx:1.14 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2019:2925 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2019:2259-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2309-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2559-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2260-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2264-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2120-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2114-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2115-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2254-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11092-1 nginx-1.21.3-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1050 nginx: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 7, 2024
- ALAS2-2019-1342 Important: mod_http2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 30, 2019
- ELSA-2019-2925 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2019
- ELSA-2019-2799 Important: nginx:1.14 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 19, 2019
References
- VU#605641 third-party-advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- 20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 mailing-list
- USN-4099-1 vendor-advisory
- 20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 mailing-list
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- FEDORA-2019-befd924cfe vendor-advisory
- 20190822 [SECURITY] [DSA 4505-1] nginx security update mailing-list
- DSA-4505 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- FEDORA-2019-5a6a7bc12c vendor-advisory
- FEDORA-2019-6a2980de56 vendor-advisory
- FEDORA-2019-4427fd65be vendor-advisory
- FEDORA-2019-63ba15cc83 vendor-advisory
- FEDORA-2019-7a0b45fdc4 vendor-advisory
- openSUSE-SU-2019:2120 vendor-advisory
- openSUSE-SU-2019:2114 vendor-advisory
- openSUSE-SU-2019:2115 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- RHSA-2019:2745 vendor-advisory
- RHSA-2019:2746 vendor-advisory
- RHSA-2019:2775 vendor-advisory
- RHSA-2019:2799 vendor-advisory
- RHSA-2019:2925 vendor-advisory
- RHSA-2019:2939 vendor-advisory
- RHSA-2019:2946 vendor-advisory
- RHSA-2019:2950 vendor-advisory
- RHSA-2019:2955 vendor-advisory
- RHSA-2019:2966 vendor-advisory
- openSUSE-SU-2019:2264 vendor-advisory
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- RHSA-2019:3933 vendor-advisory
- RHSA-2019:3935 vendor-advisory
- RHSA-2019:3932 vendor-advisory
- FEDORA-2021-d5b2c18fe6 vendor-advisory