| Package | Affected versions | Patched versions |
|---|---|---|
| traffic server | ≥ 6.0.0, ≤ 6.2.3≥ 7.0.0, ≤ 7.1.6≥ 8.0.0, ≤ 8.0.3 | |
| swiftnio | ≥ 1.0.0, ≤ 1.4.0 | |
| big-ip local traffic manager | ≥ 11.6.1, < 11.6.5.1≥ 12.1.0, < 12.1.5.1≥ 13.1.0, < 13.1.3.2≥ 14.0.0, < 14.0.1.1≥ 14.1.0, < 14.1.2.1≥ 15.0.0, < 15.0.1.1 | 11.6.5.112.1.5.113.1.3.214.0.1.114.1.2.115.0.1.1 |
| web gateway | ≥ 7.7.2.0, < 7.7.2.24≥ 7.8.2.0, < 7.8.2.13≥ 8.1.0, < 8.2.0 | 7.7.2.247.8.2.138.2.0 |
| node.js | ≥ 10.0.0, ≤ 10.12.0≥ 10.13.0, < 10.16.3≥ 12.0.0, < 12.8.1≥ 8.0.0, ≤ 8.8.1≥ 8.9.0, < 8.16.1 | 10.16.312.8.18.16.1 |
| graalvm | = 19.2.0 | |
| developer tools | = 1.0 | |
| jboss core services | = 1.0 | |
| jboss enterprise application platform | = 7.2.0= 7.3.0 | |
| openshift container platform | = 3.10= 3.11= 3.9= 4.1= 4.2 | |
| openshift service mesh | = 1.0 | |
| openstack | = 14 | |
| quay | = 3.0.0 | |
| single sign-on | = 7.3 | |
| software collections | = 1.0 |
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free