CVE-2020-11080: Denial of service in nghttp2
A resource consumption vulnerability was found in nghttp2. This flaw allows an attacker to repeatedly construct an overly large HTTP/2 SETTINGS frame with a length of 14,400 bytes that causes excessive CPU usage, leading to a denial of service.
Other sources
In nghttp2 before version 1.41.0, if an overly large HTTP/2 SETTINGS frame with a length of 14,400 bytes is repeatedly constructed it can cause the CPU to spike to 100% and cause a DoS.
— Red Hat
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2onframerecvcallback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2020-11080?
The severity of CVE-2020-11080 is classified as a denial of service vulnerability due to excessive CPU consumption.
How do I fix CVE-2020-11080?
To fix CVE-2020-11080, update nghttp2 to version 1.41.0 or later.
Which versions of nghttp2 are affected by CVE-2020-11080?
CVE-2020-11080 affects nghttp2 versions prior to 1.41.0.
What type of vulnerability is CVE-2020-11080?
CVE-2020-11080 is a resource consumption vulnerability allowing for denial of service.
Is this vulnerability specific to certain operating systems or distributions?
Yes, CVE-2020-11080 affects multiple Red Hat and Debian distributions.