CVE & CISA-KEV Catalog

CVE-2020-11080

LOWEPSS 92th pctl
3.7
CVSS v3
NVD

Description

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.

CWE-707CWE-400Resource Exhaustion

How to fix

Remediation Available
nghttp2Debian
Fixed in:1.41.0-1CVE-2020-11080
Fixed in:1.41.0-1CVE-2020-11080
Fixed in:1.41.0-1CVE-2020-11080
Fixed in:1.41.0-1CVE-2020-11080
libnghttp2-14Ubuntu
Fixed in:1.7.1-1ubuntu0.1~esm1USN-6142-1
Fixed in:1.30.0-1ubuntu1+esm1USN-6142-1
Fixed in:1.40.0-1ubuntu0.1USN-6142-1
libnghttp2-devUbuntu
Fixed in:1.7.1-1ubuntu0.1~esm1USN-6142-1
Fixed in:1.30.0-1ubuntu1+esm1USN-6142-1
Fixed in:1.40.0-1ubuntu0.1USN-6142-1
nghttp2Ubuntu
Fixed in:1.7.1-1ubuntu0.1~esm1USN-6142-1
Fixed in:1.30.0-1ubuntu1+esm1USN-6142-1
Fixed in:1.40.0-1ubuntu0.1USN-6142-1
nghttp2-clientUbuntu
Fixed in:1.7.1-1ubuntu0.1~esm1USN-6142-1
Fixed in:1.30.0-1ubuntu1+esm1USN-6142-1
Fixed in:1.40.0-1ubuntu0.1USN-6142-1
nghttp2-proxyUbuntu
Fixed in:1.7.1-1ubuntu0.1~esm1USN-6142-1
Fixed in:1.30.0-1ubuntu1+esm1USN-6142-1
Fixed in:1.40.0-1ubuntu0.1USN-6142-1
nghttp2-serverUbuntu
Fixed in:1.7.1-1ubuntu0.1~esm1USN-6142-1
Fixed in:1.30.0-1ubuntu1+esm1USN-6142-1
Fixed in:1.40.0-1ubuntu0.1USN-6142-1
Node.jsWindows application
Affected:12.13.0 12.18.0Fixed in:12.18.0Node.js Foundation
Affected:10.13.0 10.21.0Fixed in:10.21.0Node.js Foundation
Node.js (LTS)Windows application
Affected:10.13.0 10.21.0Fixed in:10.21.0Node.js Foundation
Affected:12.13.0 12.18.0Fixed in:12.18.0Node.js Foundation

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityNone
IntegrityNone
AvailabilityLow

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploit Intelligence

5.32%probability of exploitation in 30 days
92ndpercentile

High risk: more likely to be exploited than 92% of all known CVEs.

References

Embed a live status badge for CVE-2020-11080
CVE-2020-11080 severity badge

Markdown

[![CVE-2020-11080](https://tridentstack.com/cve/badge/CVE-2020-11080.svg)](https://tridentstack.com/cve/CVE-2020-11080)

HTML

<a href="https://tridentstack.com/cve/CVE-2020-11080"><img src="https://tridentstack.com/cve/badge/CVE-2020-11080.svg" alt="CVE-2020-11080"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.