| Package | Affected versions | Patched versions |
|---|---|---|
| traffic server | ≥ 6.0.0, ≤ 6.2.3≥ 7.0.0, ≤ 7.1.6≥ 8.0.0, ≤ 8.0.3 | |
| swiftnio | ≥ 1.0.0, ≤ 1.4.0 | |
| nginx | ≥ 1.17.0, ≤ 1.17.2≥ 1.9.5, < 1.16.1 | 1.16.1 |
| web gateway | ≥ 7.7.2.0, < 7.7.2.24≥ 7.8.2.0, < 7.8.2.13≥ 8.1.0, < 8.2.0 | 7.7.2.247.8.2.138.2.0 |
| node.js | ≥ 10.0.0, ≤ 10.12.0≥ 10.13.0, < 10.16.3≥ 12.0.0, < 12.8.1≥ 8.0.0, ≤ 8.8.1≥ 8.9.0, < 8.16.1 | 10.16.312.8.18.16.1 |
| enterprise communications broker | = 3.1.0= 3.2.0 | |
| graalvm | = 19.2.0 | |
| jboss core services | = 1.0 | |
| jboss enterprise application platform | = 7.2.0= 7.3.0 | |
| openshift service mesh | = 1.0 | |
| quay | = 3.0.0 | |
| software collections | = 1.0 |
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free