PT-2020-4061 · Nghttp2+9 · Nghttp2+9
Published
2020-01-24
·
Updated
2026-05-18
·
CVE-2020-11080
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
nghttp2 versions prior to 1.41.0
Description:
The issue is related to the handling of HTTP/2 SETTINGS frames in nghttp2, where an overly large frame payload can cause a denial of service. A malicious client can construct a SETTINGS frame with a large number of settings entries, causing the CPU to spike at 100%. This can be achieved by sending multiple SETTINGS frames with a length of 14,400 bytes, containing 2400 individual settings entries.
Recommendations:
For versions prior to 1.41.0, update to nghttp2 version 1.41.0 to resolve the issue.
As a temporary workaround, consider implementing the
nghttp2 on frame recv callback callback to drop the connection if a SETTINGS frame with a large number of settings entries (e.g., > 32) is received.Fix
DoS
Resource Exhaustion
Improper Neutralization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Rocky Linux
Suse
Ubuntu
Nghttp2