Resource exhaustion in Nghttp2
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.053 (92.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 92nd percentile — 92.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.053 · newest: 0.053 · change: 0.000
Affected products
- Nghttp2 — versions < 1.41.0
- Node.js
- Oracle Banking Extensibility Workbench — versions 14.3.0, 14.4.0
- Oracle Blockchain Platform
- Oracle Enterprise Communications Broker — versions 3.1.0, 3.2.0
- Oracle Graalvm — versions 19.3.2, 20.1.0
- Oracle MySQL
- Debian Linux — versions 9.0, 10.0
- Fedoraproject Fedora — versions 31, 33
- openSUSE Leap — versions 15.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.debian.org/security/2020/dsa-4696 (vendor-advisory, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html (vendor-advisory, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.oracle.com/security-alerts/cpujul2020.html (Third Party Advisory)
- github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr (Patch, Third Party Advisory)
- github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090 (Patch, Third Party Advisory)
- github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394 (Patch, Third Party Advisory)
- www.oracle.com/security-alerts/cpuoct2020.html (Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.oracle.com/security-alerts/cpujan2021.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-11080?
- CVE-2020-11080 is a low-severity vulnerability in Nghttp2, classified under CWE-707. CVSS score: 3.7/10. Published 2020-06-03.
- How severe is CVE-2020-11080?
- Low severity. CVSS v3 base score is 3.7 out of 10.
- Is CVE-2020-11080 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.