| Package | Affected versions | Patched versions |
|---|---|---|
| io.netty:netty-codec-http2 | < 4.1.100.Final | 4.1.100.Final |
A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack.
This is a DDOS attack, any http2 server is affected and so you should update as soon as possible.
This is patched in version 4.1.100.Final.
A user can limit the amount of RST frames that are accepted per connection over a timeframe manually using either an own Http2FrameListener implementation or an ChannelInboundHandler implementation (depending which http2 API is used).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free