CVE-2020-11080

Published: Jun 3, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

Affected (23)

Products: Nghttp2: Nghttp2 · Debian: Debian Linux · Opensuse: Leap · +3 more

Show all products

Nghttp2: Nghttp2 · Debian: Debian Linux · Opensuse: Leap · Fedoraproject: Fedora · Oracle: Banking Extensibility Workbench, Blockchain Platform, Enterprise Communications Broker, Graalvm, Mysql · Nodejs: Node.js

1 product

1 product

1 product

1 product

5 products

Banking Extensibility Workbench

Blockchain Platform

Enterprise Communications Broker

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nghttp2 Nghttp2	version < 1.41.0

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.1

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 33

Configuration E

12 vulnerable

Vulnerable Software	Affected Versions
Oracle Banking Extensibility Workbench	Version 14.3.0
Oracle Banking Extensibility Workbench	Version 14.4.0
Oracle Blockchain Platform	version < 21.1.2
Oracle Enterprise Communications Broker	Version 3.1.0
Oracle Enterprise Communications Broker	Version 3.2.0
Oracle Graalvm	Version 19.3.2
Oracle Graalvm	Version 20.1.0
Oracle Mysql	7.3.0 ≤ version ≤ 7.3.30
Oracle Mysql	7.4.0 ≤ version ≤ 7.4.29
Oracle Mysql	7.5.0 ≤ version ≤ 7.5.19
Oracle Mysql	7.6.0 ≤ version ≤ 7.6.15
Oracle Mysql	8.0.0 ≤ version ≤ 8.0.21

Configuration F

5 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	10.0.0 ≤ version ≤ 10.12.0
Nodejs Node.js	12.0.0 ≤ version ≤ 12.12.0
Nodejs Node.js	14.0.0 ≤ version ≤ 14.4.0
Nodejs Node.js	10.13.0 ≤ version < 10.21.0
Nodejs Node.js	12.13.0 ≤ version < 12.18.0

Related CWEs

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Improper Neutralization

The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.

References (28)

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr

Source: security-advisories@github.com

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html

Source: security-advisories@github.com

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html

Source: security-advisories@github.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/

Source: security-advisories@github.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/

Source: security-advisories@github.com

https://www.debian.org/security/2020/dsa-4696

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: security-advisories@github.com

Not ApplicableThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: security-advisories@github.com

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: security-advisories@github.com

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: security-advisories@github.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2020/dsa-4696

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Not ApplicableThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpujan2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpujul2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com/security-alerts/cpuoct2020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.