The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| nvd@nist.gov | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | 3.9 | 3.6 |
Products Affected
| Vendor | Product | Version |
|---|---|---|
| redhat | quay | 3.0.0 |
| f5 | big-ip_access_policy_manager | 17.1.0 |
| netty | netty | * |
| redhat | self_node_remediation_operator | - |
| openresty | openresty | * |
| cisco | secure_malware_analytics | * |
| redhat | jboss_a-mq | 7 |
| f5 | big-ip_access_policy_manager | * |
| konghq | kong_gateway | * |
| linkerd | linkerd | 2.14.0 |
| f5 | big-ip_next_service_proxy_for_kubernetes | * |
| microsoft | asp.net_core | * |
| f5 | big-ip_ssl_orchestrator | * |
| microsoft | .net | * |
| redhat | integration_camel_k | - |
| linkerd | linkerd | 2.14.1 |
| amazon | opensearch_data_prepper | * |
| f5 | big-ip_application_security_manager | 17.1.0 |
| debian | debian_linux | 10.0 |
| f5 | nginx_ingress_controller | * |
| f5 | big-ip_analytics | 17.1.0 |
| nodejs | node.js | * |
| istio | istio | * |
| apache | solr | * |
| redhat | advanced_cluster_management_for_kubernetes | 2.0 |
| apache | apisix | * |
| cisco | firepower_threat_defense | * |
| redhat | service_interconnect | 1.0 |
| microsoft | windows_10_1607 | * |
| cisco | crosswork_data_gateway | * |
| microsoft | visual_studio_2022 | * |
| redhat | process_automation | 7.0 |
| redhat | openshift_sandboxed_containers | - |
| f5 | big-ip_advanced_web_application_firewall | 17.1.0 |
| redhat | jboss_a-mq_streams | - |
| netapp | oncommand_insight | - |
| linkerd | linkerd | 2.13.1 |
| envoyproxy | envoy | 1.25.9 |
| cisco | connected_mobile_experiences | * |
| f5 | big-ip_ssl_orchestrator | 17.1.0 |
| fedoraproject | fedora | 38 |
| cisco | nx-os | * |
| f5 | big-ip_ddos_hybrid_defender | 17.1.0 |
| varnish_cache_project | varnish_cache | * |
| redhat | machine_deletion_remediation_operator | - |
| redhat | openshift_secondary_scheduler_operator | - |
| redhat | 3scale_api_management_platform | 2.0 |
| cisco | ultra_cloud_core_-_policy_control_function | * |
| f5 | big-ip_websafe | * |
| redhat | openstack_platform | 16.2 |
| linecorp | armeria | * |
| microsoft | windows_server_2022 | - |
| netapp | astra_control_center | - |
| redhat | openstack_platform | 16.1 |
| f5 | big-ip_domain_name_system | * |
| jenkins | jenkins | * |
| cisco | ios_xr | * |
| cisco | fog_director | * |
| cisco | crosswork_situation_manager | - |
| redhat | decision_manager | 7.0 |
| redhat | build_of_quarkus | - |
| redhat | openshift_gitops | - |
| cisco | unified_contact_center_enterprise | - |
| cisco | prime_cable_provisioning | * |
| debian | debian_linux | 11.0 |
| fedoraproject | fedora | 37 |
| cisco | prime_access_registrar | * |
| microsoft | windows_11_21h2 | * |
| redhat | openshift_api_for_data_protection | - |
| f5 | big-ip_application_visibility_and_reporting | * |
| redhat | node_maintenance_operator | - |
| eclipse | jetty | * |
| f5 | big-ip_global_traffic_manager | * |
| redhat | certification_for_red_hat_enterprise_linux | 8.0 |
| redhat | openshift_dev_spaces | - |
| f5 | big-ip_carrier-grade_nat | 17.1.0 |
| cisco | ios_xe | * |
| redhat | openshift_virtualization | 4 |
| redhat | openshift_data_science | - |
| cisco | iot_field_network_director | * |
| envoyproxy | envoy | 1.24.10 |
| redhat | jboss_fuse | 6.0.0 |
| redhat | ceph_storage | 5.0 |
| f5 | big-ip_link_controller | * |
| linkerd | linkerd | * |
| redhat | openshift | - |
| ietf | http | 2.0 |
| cisco | ultra_cloud_core_-_serving_gateway_function | * |
| f5 | big-ip_analytics | * |
| f5 | big-ip_fraud_protection_service | * |
| microsoft | windows_server_2016 | - |
| f5 | big-ip_webaccelerator | * |
| redhat | satellite | 6.0 |
| redhat | migration_toolkit_for_containers | - |
| redhat | enterprise_linux | 9.0 |
| redhat | migration_toolkit_for_virtualization | - |
| akka | http_server | * |
| cisco | expressway | * |
| projectcontour | contour | * |
| cisco | prime_network_registrar | * |
| f5 | big-ip_carrier-grade_nat | * |
| cisco | crosswork_zero_touch_provisioning | * |
| proxygen | * | |
| redhat | enterprise_linux | 8.0 |
| f5 | big-ip_advanced_web_application_firewall | * |
| cisco | unified_contact_center_domain_manager | - |
| cisco | enterprise_chat_and_email | - |
| cisco | unified_attendant_console_advanced | - |
| redhat | certification_for_red_hat_enterprise_linux | 9.0 |
| caddyserver | caddy | * |
| redhat | openshift_container_platform | 4.0 |
| redhat | logging_subsystem_for_red_hat_openshift | - |
| redhat | web_terminal | - |
| cisco | secure_web_appliance_firmware | * |
| f5 | big-ip_advanced_firewall_manager | 17.1.0 |
| f5 | big-ip_global_traffic_manager | 17.1.0 |
| redhat | node_healthcheck_operator | - |
| f5 | big-ip_websafe | 17.1.0 |
| redhat | openshift_container_platform_assisted_installer | - |
| f5 | big-ip_application_security_manager | * |
| microsoft | azure_kubernetes_service | * |
| redhat | openshift_developer_tools_and_services | - |
| f5 | nginx | * |
| redhat | openshift_service_mesh | 2.0 |
| f5 | nginx_plus | r29 |
| redhat | cert-manager_operator_for_red_hat_openshift | - |
| redhat | cost_management | - |
| kazu-yamamoto | http2 | * |
| golang | networking | * |
| redhat | network_observability_operator | - |
| nghttp2 | nghttp2 | * |
| f5 | big-ip_fraud_protection_service | 17.1.0 |
| microsoft | cbl-mariner | * |
| redhat | integration_service_registry | - |
| microsoft | windows_10_22h2 | * |
| f5 | big-ip_policy_enforcement_manager | 17.1.0 |
| linkerd | linkerd | 2.13.0 |
| redhat | support_for_spring_boot | - |
| f5 | big-ip_application_acceleration_manager | 17.1.0 |
| redhat | jboss_core_services | - |
| redhat | migration_toolkit_for_applications | 6.0 |
| cisco | telepresence_video_communication_server | * |
| apache | tomcat | 11.0.0 |
| golang | go | * |
| redhat | jboss_fuse | 7.0.0 |
| redhat | cryostat | 2.0 |
| cisco | ultra_cloud_core_-_policy_control_function | 2024.01.0 |
| envoyproxy | envoy | 1.26.4 |
| f5 | big-ip_webaccelerator | 17.1.0 |
| cisco | ultra_cloud_core_-_session_management_function | * |
| redhat | openshift_distributed_tracing | - |
| cisco | crosswork_data_gateway | 5.0 |
| redhat | openshift_serverless | - |
| traefik | traefik | * |
| microsoft | windows_10_21h2 | * |
| redhat | service_telemetry_framework | 1.5 |
| microsoft | windows_11_22h2 | * |
| redhat | jboss_enterprise_application_platform | 6.0.0 |
| traefik | traefik | 3.0.0 |
| redhat | jboss_data_grid | 7.0.0 |
| f5 | big-ip_local_traffic_manager | 17.1.0 |
| redhat | fence_agents_remediation_operator | - |
| f5 | nginx_plus | * |
| f5 | big-ip_application_acceleration_manager | * |
| redhat | run_once_duration_override_operator | - |
| f5 | big-ip_domain_name_system | 17.1.0 |
| cisco | unified_contact_center_enterprise_-_live_data_server | * |
| redhat | openshift_pipelines | - |
| f5 | big-ip_ddos_hybrid_defender | * |
| f5 | big-ip_link_controller | 17.1.0 |
| apache | traffic_server | * |
| redhat | build_of_optaplanner | 8.0 |
| f5 | big-ip_next | 20.0.1 |
| f5 | big-ip_application_visibility_and_reporting | 17.1.0 |
| dena | h2o | * |
| redhat | single_sign-on | 7.0 |
| f5 | big-ip_local_traffic_manager | * |
| microsoft | windows_10_1809 | * |
| cisco | data_center_network_manager | - |
| apache | tomcat | * |
| microsoft | windows_server_2019 | - |
| grpc | grpc | 1.57.0 |
| envoyproxy | envoy | 1.27.0 |
| cisco | secure_dynamic_attributes_connector | * |
| cisco | business_process_automation | * |
| f5 | big-ip_policy_enforcement_manager | * |
| f5 | nginx_plus | r30 |
| redhat | integration_camel_for_spring_boot | - |
| f5 | big-ip_advanced_firewall_manager | * |
| redhat | jboss_enterprise_application_platform | 7.0.0 |
| redhat | advanced_cluster_security | 4.0 |
| redhat | ansible_automation_platform | 2.0 |
| golang | http2 | * |
| cisco | prime_infrastructure | * |
| grpc | grpc | * |
| cisco | unified_contact_center_management_portal | - |
| redhat | enterprise_linux | 6.0 |
| redhat | openstack_platform | 17.1 |
| apple | swiftnio_http/2 | * |
| debian | debian_linux | 12.0 |
| redhat | advanced_cluster_security | 3.0 |
In Linkerd edge releases before edge-25.2.1, and Buoyant Enterprise for Linkerd releases 2.13.0–2.13.7, 2.14.0–2.14.10, 2.15.0–2.15.7, 2.16.0–2.16.4, and 2.17.0–2.17.1, resource exhaustion can occur for Linkerd proxy metrics.
CVSS 3.x
| Source | Score | Severity | Vector | Exploitability | Impact |
|---|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H | 2.2 | 4.2 |
Products Affected
| Vendor | Product | Version |
|---|---|---|
| linkerd | linkerd | * |
| linkerd | buoyant | * |