Name of the Vulnerable Software and Affected Versions:

Apache HTTP Server versions prior to 2.4.57

Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0

F5 NGINX products (affected versions not specified)

gRPC-Go versions prior to 1.56.3, 1.57.1, and 1.58.3

IBM HTTP Server (powered by Apache) for IBM i (affected versions not specified)

nghttp2 versions prior to 1.57.0

Node.js (affected versions not specified)

swift-nio-http2 versions prior to 1.28

Tomcat versions 9.0.0 through 9.0.25

Description:

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly. This vulnerability can be exploited by an attacker to launch a Distributed Denial of Service (DDoS) attack, overwhelming the server with a large number of requests and rendering it unavailable to legitimate users. The estimated number of potentially affected devices worldwide is not specified, but the vulnerability has been exploited in the wild, with Google reporting a peak of 398 million requests per second. Technical details about exploitation include the ability to reset streams immediately, allowing an attacker to create an indefinite number of requests in flight, and the use of the RST STREAM frame to cancel requests.

Recommendations:

For Apache HTTP Server versions prior to 2.4.57, update to version 2.4.57 or later.

For Bamboo Data Center and Server versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.1, and 9.3.0, upgrade to a release greater than or equal to 9.2.7 for version 9.2, or greater than or equal to 9.3.5 for version 9.3.

For F5 NGINX products, update the configuration to limit the number of concurrent streams to 128 by default and preserve HTTP connections up to 1000 requests.

For gRPC-Go versions prior to 1.56.3, 1.57.1, and 1.58.3, update to version 1.56.3, 1.57.1, or 1.58.3, or later, and ensure the grpc.MaxConcurrentStreams server option is applied to limit the server's resources used for any single connection.

For IBM HTTP Server (powered by Apache) for IBM i, update to a version that includes the fix for the vulnerability.

For nghttp2 versions prior to 1.57.0, update to version 1.57.0 or later.

For Node.js, update to a version that includes the fix for the vulnerability.

For swift-nio-http2 versions prior to 1.28, update to version 1.28 or later.

For Tomcat versions 9.0.0 through 9.0.25, update to a version that includes the fix for the vulnerability.