HTTP2: Microsoft Windows IIS HTTP2 Resource Loop Denial of Service

This signature detects attempts to exploit a known vulnerability against Microsoft Windows IIS. A successful attack can result in a denial-of-service condition.

Extended Description

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Affected Products

Nodejs node.js

References

CVE: CVE-2019-9513

URL: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Short Name

HTTP2:MS-IIS-RES-LOOP-DOS

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP2: Microsoft Windows IIS HTTP2 Resource Loop Denial of Service

Extended Description

Affected Products

References

Found a potential security threat?