Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Summary

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Timeline

1. Aug 13, 2019, 12:00 AM UTCCVE published
2. Aug 4, 2024, 9:54 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• stdlibGo

  fixed in 1.11.13; From 1.12.0-0 · fixed in 1.12.8

• golang.org/x/netGo

  fixed in 0.0.0-20190813141303-74dc4d7220e7

References 25