Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

Summary

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Timeline

1. Aug 13, 2019, 8:50 PM UTCCVE published
2. Aug 4, 2024, 9:54 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

References 25