Most recent entries from all

ALSA-2020:2755 — Important: nghttp2 security update

Affected: AlmaLinux:8: libnghttp2, AlmaLinux:8: libnghttp2-devel, AlmaLinux:8: nghttp2

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2020-04461

Withdrawn: BELL-CVE-2020-11080 — CVE-2020-11080 does not affect BellSoft software

Withdrawn by the publisher.

BIT-node-2020-11080 — Denial of service in nghttp2

Affected: Bitnami: node

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

CLEANSTART-2024-IB47069 — In nghttp2 before version 1

Affected: CleanStart: nghttp2

Security vulnerability affects the nghttp2 package. In nghttp2 before version 1.

cnvd-2021-31262

EUVD-2026-243497

fkie_cve-2020-11080

gsd-2020-11080

ICSA-22-090-02 — Hitachi Energy e-mesh EMS

A vulnerability exists in a specific Node.js function, which could allow various kinds of memory corruption and cause a denial-of-service condition.CVE-2020-8174 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is vulnerable to a Use After Free bug in its TLS implementation. This could cause corruption of memory leading to a denial-of-service condition.CVE-2020-8265 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is vulnerable to an error in the HTTP/2 session frame, which is limited to 32 settings by default. An attacker could consume all available CPU resources causing a denial-of-service condition.CVE-2020-11080 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The affected product version of Node.js is affected by too many connection attempts with an unknown protocol. This could allow an attacker to cause a denial-of-service condition.CVE-2021-22883 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

msrc_CVE-2020-11080 — Denial of service in nghttp2

msrc_CVE-2020-11080

openSUSE-SU-2020:0802-1 — Security update for nodejs8

Security update for nodejs8

RHSA-2020:2523 — Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.1.2 servicemesh-proxy security update

nghttp2: overly large SETTINGS frames can lead to DoS

SUSE-SU-2020:1568-1 — Security update for nodejs10

Security update for nodejs10

UBUNTU-CVE-2020-11080

Affected: Ubuntu:Pro:16.04:LTS: nghttp2, Ubuntu:Pro:18.04:LTS: nghttp2, Ubuntu:20.04:LTS: nghttp2

WID-SEC-W-2023-1374 — Node.js: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Angriff durchzuführen, Sicherheitsmechanismen zu umgehen oder seine Privilegien zu erweitern.