Priority MEDIUM 40
HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.
Vulnerabilities
5 records
Priority MEDIUM 49
The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler read…
Priority MEDIUM 40
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Priority MEDIUM 40
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing.
Priority MEDIUM 40
When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler.