Read the docs
TI-2020-08954 Aliases CVE-2020-11080

Denial of service in nghttp2

Priority MEDIUM 41CWE-707Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05316 92nd percentileScored 2026-11-07
Fix Fixed nghttp2 (nghttp2): 1.41.0Red Hat: 15 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nghttp2nghttp2before 1.41.01.41.0Patch availableCNA
  • nghttp2 Vendornghttp2 Affected before 1.41.0 Fixed in 1.41.0 Patch available CNA

CPE configurations NVD · 19

CPEVersionsRoleVendor
cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*before 1.41.0Vulnerablenghttp2
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:*14.4.0VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableOracle
  • cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:* Versions before 1.41.0 Vulnerable ·nghttp2
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.4.0:*:*:*:*:*:*:* Versions 14.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Oracle
Show 9 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:*19.3.2VulnerableOracle
cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:*20.1.0VulnerableOracle
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*7.3.0 – 7.3.30; 7.4.0 – 7.4.29; 7.5.0 – 7.5.19; 7.6.0 – 7.6.15; 8.0.0 – 8.0.21VulnerableOracle
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*10.0.0 – 10.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*10.13.0 to before 10.21.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*12.0.0 – 12.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*12.13.0 to before 12.18.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*14.0.0 – 14.4.0VulnerableNodeJS
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:graalvm:19.3.2:*:*:*:enterprise:*:*:* Versions 19.3.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:graalvm:20.1.0:*:*:*:enterprise:*:*:* Versions 20.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions 7.3.0 – 7.3.30; 7.4.0 – 7.4.29; 7.5.0 – 7.5.19; 7.6.0 – 7.6.15; 8.0.0 – 8.0.21 Vulnerable ·Oracle
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 10.0.0 – 10.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 10.13.0 to before 10.21.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 – 12.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 12.13.0 to before 12.18.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 14.0.0 – 14.4.0 Vulnerable ·NodeJS

Remediation

  • Fix · CNA nghttp2 (nghttp2) Fixed in 1.41.0

Red Hat 15 advisories

  • RHSA-2020:3084 Released 2020-07-21 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-nodejs-10.21.0-3.el7, rh-nodejs10-nodejs-devel-10.21.0-3.el7, rh-nodejs10-nodejs-docs-10.21.0-3.el7 +1
  • RHSA-2020:3042 Released 2020-07-21 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream E4S (v. 8.0) nodejs-1:10.21.0-3.module+el8.0.0+7067+054302d1.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.0.0+7067+054302d1.src::nodejs:10, nodejs-1:10.21.0-3.module+el8.0.0+7067+054302d1.x86_64::nodejs:10 +11
  • RHSA-2020:2895 Released 2020-07-13 · Red Hat rating Important
    rh-nodejs12-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs12-nodejs-12.18.2-1.el7, rh-nodejs12-nodejs-devel-12.18.2-1.el7, rh-nodejs12-nodejs-docs-12.18.2-1.el7 +1
Show 12 more Red Hat advisories
  • RHSA-2020:2852 Released 2020-07-07 · Red Hat rating Important
    nodejs:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.aarch64::nodejs:12, nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.ppc64le::nodejs:12, nodejs-1:12.18.2-1.module+el8.2.0+7233+61d664c1.s390x::nodejs:12 +19
  • RHSA-2020:2848 Released 2020-07-07 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.21.0-3.module+el8.2.0+7071+d2377ea3.aarch64::nodejs:10, nodejs-1:10.21.0-3.module+el8.2.0+7071+d2377ea3.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.2.0+7071+d2377ea3.s390x::nodejs:10 +19
  • RHSA-2020:2849 Released 2020-07-07 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.aarch64::nodejs:10, nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.ppc64le::nodejs:10, nodejs-1:10.21.0-3.module+el8.1.0+7070+fe09e702.s390x::nodejs:10 +19
  • RHSA-2020:2847 Released 2020-07-07 · Red Hat rating Important
    nodejs:12 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 8.1) nodejs-1:12.18.2-1.module+el8.1.0+7232+f8b5ede5.aarch64::nodejs:12, nodejs-1:12.18.2-1.module+el8.1.0+7232+f8b5ede5.ppc64le::nodejs:12, nodejs-1:12.18.2-1.module+el8.1.0+7232+f8b5ede5.s390x::nodejs:12 +19
  • RHSA-2020:2850 Released 2020-07-07 · Red Hat rating Important
    nghttp2 security update
    • Red Hat Enterprise Linux BaseOS E4S (v. 8.0) libnghttp2-1.33.0-1.el8_0.2, nghttp2-1.33.0-1.el8_0.2
  • RHSA-2020:2823 Released 2020-07-06 · Red Hat rating Important
    nghttp2 security update
    • Red Hat CodeReady Linux Builder EUS (v. 8.1) libnghttp2-devel-1.33.0-3.el8_1.1, nghttp2-1.33.0-3.el8_1.1
    • Red Hat Enterprise Linux BaseOS EUS (v. 8.1) libnghttp2-1.33.0-3.el8_1.1, nghttp2-1.33.0-3.el8_1.1
  • RHSA-2020:2784 Released 2020-07-01 · Red Hat rating Important
    httpd24-nghttp2 security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-libnghttp2-1.7.1-8.el6.1, httpd24-libnghttp2-devel-1.7.1-8.el6.1, httpd24-nghttp2-1.7.1-8.el6.1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-libnghttp2-1.7.1-8.el7.1, httpd24-libnghttp2-devel-1.7.1-8.el7.1, httpd24-nghttp2-1.7.1-8.el7.1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-libnghttp2-1.7.1-8.el7.1, httpd24-libnghttp2-devel-1.7.1-8.el7.1, httpd24-nghttp2-1.7.1-8.el7.1
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) httpd24-libnghttp2-1.7.1-8.el7.1, httpd24-libnghttp2-devel-1.7.1-8.el7.1, httpd24-nghttp2-1.7.1-8.el7.1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-libnghttp2-1.7.1-8.el6.1, httpd24-libnghttp2-devel-1.7.1-8.el6.1, httpd24-nghttp2-1.7.1-8.el6.1
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-libnghttp2-1.7.1-8.el7.1, httpd24-libnghttp2-devel-1.7.1-8.el7.1, httpd24-nghttp2-1.7.1-8.el7.1
  • RHSA-2020:2755 Released 2020-06-25 · Red Hat rating Important
    nghttp2 security update
    • Red Hat CodeReady Linux Builder (v. 8) libnghttp2-devel-1.33.0-3.el8_2.1, nghttp2-1.33.0-3.el8_2.1
    • Red Hat Enterprise Linux BaseOS (v. 8) libnghttp2-1.33.0-3.el8_2.1, nghttp2-1.33.0-3.el8_2.1
  • RHSA-2020:2646 Released 2020-06-22 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update
    • Red Hat JBoss Core Services
  • RHSA-2020:2644 Released 2020-06-22 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-curl-7.64.1-36.jbcs.el6, jbcs-httpd24-httpd-2.4.37-57.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el6 +18
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.64.1-36.jbcs.el7, jbcs-httpd24-httpd-2.4.37-57.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el7 +19
  • RHSA-2020:2524 Released 2020-06-11 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 1.0 servicemesh-proxy security update
    • OpenShift Service Mesh 1.0 servicemesh-proxy-1.0.10-3.el8
  • RHSA-2020:2523 Released 2020-06-11 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 1.1.2 servicemesh-proxy security update
    • OpenShift Service Mesh 1.1 servicemesh-proxy-1.1.2-3.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1.0Fixed RHSA-2020:2524
OpenShift Service Mesh 1.1Fixed RHSA-2020:2523
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2020:2755
Red Hat CodeReady Linux Builder EUS (v. 8.1)Fixed RHSA-2020:2823
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:2848, RHSA-2020:2852
Red Hat Enterprise Linux AppStream E4S (v. 8.0)Fixed RHSA-2020:3042
Red Hat Enterprise Linux AppStream EUS (v. 8.1)Fixed RHSA-2020:2847, RHSA-2020:2849
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2020:2755
Red Hat Enterprise Linux BaseOS E4S (v. 8.0)Fixed RHSA-2020:2850
Red Hat Enterprise Linux BaseOS EUS (v. 8.1)Fixed RHSA-2020:2823
Red Hat JBoss Core ServicesFixed RHSA-2020:2646
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2020:2644
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2020:2644
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2020:2784
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:2784, RHSA-2020:2895, RHSA-2020:3084
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2020:2784, RHSA-2020:2895, RHSA-2020:3084
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2020:2784, RHSA-2020:2895, RHSA-2020:3084
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2020:2784
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:2784, RHSA-2020:2895, RHSA-2020:3084
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11080

References

Patch 4

Advisory 9

Other 1

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2023-18006 Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec CVSS 3.1HIGH 7.5
  • TI-2024-18758 Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage CVSS 3.1MEDIUM 5.3
  • TI-2018-15818 nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation… CVSS 3.1HIGH 7.5
  • TI-2015-07121 The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified… CVSS 3.0CRITICAL 10.0
  • TI-2026-21585 nghttp2 Denial of service: Assertion failure due to the missing state validation CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences