HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

guest · Aug 13, 2019

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion
Vulnerability Note VU#605641
August 13, 2019
https://www.kb.cert.org/vuls/id/605641/

Overview
Multiple HTTP/2 implementations are vulnerable to a variety of denial-of-service (DoS) attacks.
Description
The Security Considerations section of RFC7540 discusses some of the considerations needed for HTTP/2 connections as they demand more resources to operate than HTTP/1.1 connections. While it generally covers expected behavior considerations, how to mitigate abnormal behavior is left to the implementer which can leave it open to the following weaknesses. [...]
Impact
These attacks can consume excessive system resources, potentially enough that a single end-system could cause issues on multiple servers that may lead to Distributed DoS (DDoS) attacks.
Solution
Install the latest updates from HTTP/2 implementers.
Click to expand...

Log in or Sign up

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

guest Guest

Log in or Sign up

HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion

guest Guest

Useful Searches