Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Summary

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Timeline

1. Aug 13, 2019, 8:50 PM UTCCVE published
2. Aug 4, 2024, 9:54 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• stdlibGo

  fixed in 1.11.13; From 1.12.0-0 · fixed in 1.12.8

• golang.org/x/netGo

  fixed in 0.0.0-20190813141303-74dc4d7220e7

References 25