HTTP2: Nginx 0-Length Headers Denial of Service

This signature detects attempts to exploit a known vulnerability against Nginx. A successful attack can result in a denial-of-service condition.

Extended Description

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Affected Products

Nodejs node.js

References

CVE: CVE-2019-9516

URL: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/

Short Name

HTTP2:NGINX-ZERO-HEADER-DOS

Severity

Major

Recommended

True

Recommended Action

Drop

HTTP2: Nginx 0-Length Headers Denial of Service

Extended Description

Affected Products

References

Found a potential security threat?