3.7
Low
CVE-2020-11080 In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service
Description
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nghttp2 1.41 | earliest → < 1.41.0 | 1.41.0 |
References
- DSA-4696 www.debian.org
- openSUSE-SU-2020:0802 lists.opensuse.org
- FEDORA-2020-f7d15c8b77 lists.fedoraproject.org
- www.oracle.com www.oracle.com
- github.com github.com
- github.com github.com
- github.com github.com
- www.oracle.com www.oracle.com
- FEDORA-2020-43d5a372fc lists.fedoraproject.org
- www.oracle.com www.oracle.com
- www.oracle.com www.oracle.com
- [debian-lts-announce] 20211017 [SECURITY] [DLA 2786-1] nghttp2 security update lists.debian.org
- www.oracle.com www.oracle.com
- [debian-lts-announce] 20231016 [SECURITY] [DLA 3621-1] nghttp2 security update lists.debian.org
Timeline
- Published
- Last modified
Other CVEs of nghttp2
The 5 CVEs of nghttp2 →
CVE-2026-58055
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header…
5.4
Medium
CVE-2026-27135
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
7.5
High
CVE-2024-28182
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
5.3
Medium
CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion)
Not rated