Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Swiftnio | Apple | 1.0.0 (including) | 1.4.0 (including) |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-httpd-0:2.4.29-41.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-nghttp2-0:1.39.2-1.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apr-0:1.6.3-63.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-curl-0:7.64.1-14.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-jansson-0:2.11-20.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el6 | * |
| JBoss Core Services on RHEL 6 | RedHat | jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el6 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-httpd-0:2.4.29-41.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-nghttp2-0:1.39.2-1.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apr-0:1.6.3-63.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-apr-util-0:1.6.1-48.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-brotli-0:1.0.6-7.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-curl-0:7.64.1-14.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-httpd-0:2.4.37-33.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-jansson-0:2.11-20.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_cluster-native-0:1.3.12-9.Final_redhat_2.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_jk-0:1.2.46-22.redhat_1.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-mod_security-0:2.9.2-16.GA.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-nghttp2-0:1.39.2-4.jbcs.el7 | * |
| JBoss Core Services on RHEL 7 | RedHat | jbcs-httpd24-openssl-1:1.1.1-25.jbcs.el7 | * |
| Openshift Service Mesh 1.0 | RedHat | kiali-0:v1.0.6.redhat1-1.el7 | * |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-0:1.0.1-8.el8 | * |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-cni-0:1.0.1-8.el8 | * |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-grafana-0:6.2.2-21.el8 | * |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-operator-0:1.0.1-8.el8 | * |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-prometheus-0:2.7.2-22.el8 | * |
| OpenShift Service Mesh 1.0 | RedHat | servicemesh-proxy-0:1.0.1-7.el8 | * |
| Red Hat Enterprise Linux 8 | RedHat | nginx:1.14-8000020190830002848.f8e95b4e | * |
| Red Hat Enterprise Linux 8 | RedHat | nodejs:10-8000020190911085529.f8e95b4e | * |
| Red Hat Enterprise Linux 8 | RedHat | nghttp2-0:1.33.0-1.el8_0.1 | * |
| Red Hat Fuse 7.6.0 | RedHat | undertow | * |
| Red Hat JBoss Core Services 1 | RedHat | nghttp2 | * |
| Red Hat Quay 3 | RedHat | quay3/clair-jwt:v2.0.9-7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | rh-nginx110-nginx-1:1.10.2-9.el6.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-httpd-0:2.4.34-8.el6.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 | RedHat | httpd24-nghttp2-0:1.7.1-7.el6.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nginx110-nginx-1:1.10.2-9.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nginx112-nginx-1:1.12.1-3.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nginx114-nginx-1:1.14.1-1.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs10-0:3.2-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs10-nodejs-0:10.16.3-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-httpd-0:2.4.34-8.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | httpd24-nghttp2-0:1.7.1-7.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs8-0:3.0-5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 | RedHat | rh-nodejs8-nodejs-0:8.16.1-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | rh-nginx110-nginx-1:1.10.2-9.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | rh-nginx112-nginx-1:1.12.1-3.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS | RedHat | rh-nginx114-nginx-1:1.14.1-1.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nginx110-nginx-1:1.10.2-9.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nginx112-nginx-1:1.12.1-3.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nginx114-nginx-1:1.14.1-1.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nodejs10-0:3.2-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nodejs10-nodejs-0:10.16.3-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | httpd24-httpd-0:2.4.34-8.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | httpd24-nghttp2-0:1.7.1-7.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nodejs8-0:3.0-5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS | RedHat | rh-nodejs8-nodejs-0:8.16.1-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nginx110-nginx-1:1.10.2-9.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nginx112-nginx-1:1.12.1-3.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nginx114-nginx-1:1.14.1-1.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nodejs10-0:3.2-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nodejs10-nodejs-0:10.16.3-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | httpd24-httpd-0:2.4.34-8.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | httpd24-nghttp2-0:1.7.1-7.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nodejs8-0:3.0-5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS | RedHat | rh-nodejs8-nodejs-0:8.16.1-2.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nginx110-nginx-1:1.10.2-9.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nginx112-nginx-1:1.12.1-3.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nginx114-nginx-1:1.14.1-1.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs10-0:3.2-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs10-nodejs-0:10.16.3-3.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | httpd24-httpd-0:2.4.34-8.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | httpd24-nghttp2-0:1.7.1-7.el7.1 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs8-0:3.0-5.el7 | * |
| Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUS | RedHat | rh-nodejs8-nodejs-0:8.16.1-2.el7 | * |
| Nghttp2 | Ubuntu | bionic | * |
| Nghttp2 | Ubuntu | cosmic | * |
| Nghttp2 | Ubuntu | disco | * |
| Nghttp2 | Ubuntu | esm-apps/xenial | * |
| Nghttp2 | Ubuntu | esm-infra/bionic | * |
| Nghttp2 | Ubuntu | upstream | * |
| Nghttp2 | Ubuntu | xenial | * |
| Nginx | Ubuntu | bionic | * |
| Nginx | Ubuntu | cosmic | * |
| Nginx | Ubuntu | devel | * |
| Nginx | Ubuntu | disco | * |
| Nginx | Ubuntu | eoan | * |
| Nginx | Ubuntu | focal | * |
| Nginx | Ubuntu | groovy | * |
| Nginx | Ubuntu | hirsute | * |
| Nginx | Ubuntu | impish | * |
| Nginx | Ubuntu | jammy | * |
| Nginx | Ubuntu | kinetic | * |
| Nginx | Ubuntu | lunar | * |
| Nginx | Ubuntu | mantic | * |
| Nginx | Ubuntu | noble | * |
| Nginx | Ubuntu | trusty | * |
| Nginx | Ubuntu | xenial | * |
| Nodejs | Ubuntu | bionic | * |
| Nodejs | Ubuntu | esm-apps/bionic | * |
| Nodejs | Ubuntu | esm-apps/xenial | * |
| Nodejs | Ubuntu | esm-infra-legacy/trusty | * |
| Nodejs | Ubuntu | groovy | * |
| Nodejs | Ubuntu | hirsute | * |
| Nodejs | Ubuntu | impish | * |
| Nodejs | Ubuntu | kinetic | * |
| Nodejs | Ubuntu | trusty | * |
| Nodejs | Ubuntu | trusty/esm | * |
| Nodejs | Ubuntu | xenial | * |