UpHeron
All vulnerabilities

Servers and applications

CVE-2020-11080

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this…

Severity
High 7.5
Published
3 Jun 2020
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
10.21.0, 12.18.0
Sources
NVD

Affected software

SoftwareAffected versions
Node.jsServers and applications · cpe:a:nodejs:node.js
  • From 10.0.0 up to 10.12.0
  • From 10.13.0 before 10.21.0
  • From 12.0.0 up to 12.12.0
  • From 12.13.0 before 12.18.0
  • From 14.0.0 up to 14.4.0
MySQLServers and applications · cpe:a:oracle:mysql
  • From 7.3.0 up to 7.3.30
  • From 7.4.0 up to 7.4.29
  • From 7.5.0 up to 7.5.19
  • From 7.6.0 up to 7.6.15
  • From 8.0.0 up to 8.0.21

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-11080
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-11080