Resource exhaustion in Nghttp2
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual…
EPSS: 0.053 (91.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
Affected products
- Nghttp2 — versions < 1.41.0
- Nodejs Node.js
- Oracle Banking_extensibility_workbench — versions 14.3.0, 14.4.0
- Oracle Blockchain_platform
- Oracle Enterprise_communications_broker — versions 3.1.0, 3.2.0
- Oracle Graalvm — versions 19.3.2, 20.1.0
- Oracle Mysql
- Debian Debian_linux — versions 9.0, 10.0
- Fedoraproject Fedora — versions 31, 33
- Opensuse Leap — versions 15.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (vendor-advisory, Third Party Advisory)
- security-advisories@github.com (vendor-advisory, Mailing List, Third Party Advisory)
- security-advisories@github.com (vendor-advisory)
- security-advisories@github.com (Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory)
- security-advisories@github.com (Third Party Advisory)
- security-advisories@github.com (vendor-advisory)
- security-advisories@github.com (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-11080?
- CVE-2020-11080 is a low-severity vulnerability in Nghttp2, classified under CWE-707. CVSS score: 3.7/10. Published 2020-06-03.
- How severe is CVE-2020-11080?
- Low severity. CVSS v3 base score is 3.7 out of 10.
- Is CVE-2020-11080 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.