{"id":37095,"date":"2019-10-31T22:15:43","date_gmt":"2019-10-31T19:15:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\/"},"modified":"2019-10-31T22:15:43","modified_gmt":"2019-10-31T19:15:43","slug":"v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","title":{"rendered":"Eight DoS vulnerabilities have been identified in various implementations of the HTTP\/2 protocol","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Researchers from Netflix and Google <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Netflix\/security-bulletins\/blob\/master\/advisories\/third-party\/2019-002.md\">identified<\/a><\/noindex>  have discovered eight vulnerabilities in various implementations of the HTTP\/2 protocol that allow for denial of service by sending specially crafted streams of network requests. These issues affect most HTTP servers that support HTTP\/2 to some extent, leading to exhaustion of available memory for processing or excessive CPU load. Updates addressing these vulnerabilities have already been released in <noindex><a rel=\"nofollow\" href=\"http:\/\/mailman.nginx.org\/pipermail\/nginx-announce\/2019\/000247.html\">nginx 1.16.1\/1.17.3<\/a><\/noindex> and <noindex><a rel=\"nofollow\" href=\"http:\/\/blog.kazuhooku.com\/2019\/08\/h2o-version-226-230-beta2-released.html\">H2O 2.2.6<\/a><\/noindex>, but are not yet <noindex><a rel=\"nofollow\" href=\"http:\/\/www.apache.org\/dist\/httpd\/\">available<\/a><\/noindex> for Apache httpd and <noindex><a rel=\"nofollow\" href=\"https:\/\/www.kb.cert.org\/vuls\/id\/605641\/\">other products<\/a><\/noindex>.<\/p>\n<p>The problems arose from complexities introduced into the HTTP\/2 protocol related to the use of binary structures, data stream limiting within connections, flow prioritization mechanisms, and ICMP-like control messages operating at the HTTP\/2 connection level (e.g., ping, reset, and stream settings operations). Many implementations did not properly limit control message flows, inadequately organized priority queue operations when processing requests, or used suboptimal implementations of flow control algorithms.<\/p>\n<p>Most of the identified attack methods involve sending specific requests to the server that generate a large number of responses. If the client does not read data from the socket and does not close the connection, the response buffer queue on the server side continues to fill up. This behavior creates a load on the network connection queue management system and, depending on the implementation's specifics, can lead to exhaustion of available memory or CPU resources.<\/p>\n<p>Identified vulnerabilities:<\/p>\n<ul>\n<li class=\"l\"> CVE-2019-9511 (Data Dribble) \u2014 An attacker requests a large volume of data in multiple streams, manipulating the sliding window size and stream priority, forcing the server to queue data in 1-byte blocks.\n<li class=\"l\">  CVE-2019-9512 (Ping Flood) \u2014 An attacker continuously floods ping messages through an HTTP\/2 connection, causing the internal queue of responses on the other side to fill up.\n<li class=\"l\"> CVE-2019-9513 (Resource Loop) \u2014 An attacker creates multiple request streams and continuously changes their priorities, causing a shuffle in the priority tree.\n<li class=\"l\"> CVE-2019-9514 (Reset Flood) \u2014 An attacker creates multiple streams.<br \/>\n and sends an incorrect request through each thread, causing the server to send RST_STREAM frames, but does not accept them to fill the response queue;<\/p>\n<li class=\"l\"> CVE-2019-9515 (Settings Flood) \u2014 An attacker sends a stream of empty \"SETTINGS\" frames, to which the server is required to acknowledge each request.\n<li class=\"l\">  CVE-2019-9516 (0-Length Headers Leak) \u2014 An attacker sends a stream of headers with a zero name and zero value, causing the server to allocate memory for each header and not free it until the session ends.\n<li class=\"l\">   CVE-2019-9517 (Internal Data Buffering) \u2014 An attacker opens.<br \/>\na sliding HTTP\/2 window for the server to send data without restrictions, while keeping the TCP window closed, preventing actual writing of data to the socket. The attacker then sends requests that require a large response;<\/p>\n<li class=\"l\"> CVE-2019-9518 (Empty Frames Flood) \u2014 An attacker sends a stream of frames of type DATA, HEADERS, CONTINUATION, or PUSH_PROMISE, but with empty payloads and no stream completion flag. The server spends time processing each frame, disproportionately relative to the attacker's bandwidth consumption.\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51279\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u043e\u0441\u0435\u043c\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u043f\u043e\u0442\u043e\u043a\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u0439 \u0438\u043b\u0438 \u0438\u043d\u043e\u0439 \u043c\u0435\u0440\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e HTTP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 HTTP\/2 \u0438 \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0442 \u043a \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044e \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0435\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043f\u0430\u043c\u044f\u0442\u0438 \u0438\u043b\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043d\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37095","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/en\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/en\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:15:43+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Eight DoS vulnerabilities identified in various implementations of the HTTP\/2 protocol | ProHoster","description":"Researchers from Netflix and Google have identified vulnerabilities in various implementations.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 HTTP\/2 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 8 DoS-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 Netflix \u0438 Google \u0432\u044b\u044f\u0432\u0438\u043b\u0438 \u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/v-razlichnyh-realizatsiyah-protokola-http-2-vyyavleno-8-dos-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:15:43+00:00","article:modified_time":"2019-10-31T19:15:43+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37095","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 06:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 23:22:07","updated":"2026-01-22 06:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/37095","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=37095"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/37095\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=37095"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=37095"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=37095"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}