CVE-2020-11080: Denial of service in nghttp2
Vulnerability summary
CVE-2020-11080 is a high (CVSS 7.5) Improper Neutralization vulnerability in debian debian_linux. EPSS estimates a 5.32% chance of exploitation in the next 30 days, higher than 92.6% of scored vulnerabilities.
Not severe (CVSS 3.7, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 20 · Related 11Timeline
- 03-06-2020PublishedVulnerability first disclosed.
- 09-06-2025Last modifiedVulnerability information updated.
Description
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVSS metrics
8 scores · 7 sources · 2 versions- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:LDiffers
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
5.32%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.32% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-707Improper NeutralizationThe product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being used when received from an upstream component, or before being sent to a downstream component.
- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse15 products
- nghttp2&distro=SUSE Enterprise Storage 6< 1.40.0-3.11.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 1.40.0-3.11.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 1.40.0-3.11.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.40.0-3.11.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.40.0-3.11.1
Redhat11 products
- httpd24-libnghttp2< 0:1.7.1-8.el6.1 | < 0:1.7.1-8.el7.1
- httpd24-libnghttp2-devel< 0:1.7.1-8.el6.1 | < 0:1.7.1-8.el7.1
- httpd24-nghttp2< 0:1.7.1-8.el6.1 | < 0:1.7.1-8.el7.1
- httpd24-nghttp2-debuginfo< 0:1.7.1-8.el6.1 | < 0:1.7.1-8.el7.1
- libnghttp2< 0:1.33.0-3.el8_2.1 | < 0:1.33.0-3.el8_1.1 | < 0:1.33.0-1.el8_0.2
Chainguard6 products
- mysql-8.0< 8.0.38-r0
- mysql-8.0-client< 8.0.38-r0
- mysql-8.0-dev< 8.0.38-r0
- mysql-8.0-iamguarded-compat< 8.0.38-r0
- mysql-8.0-oci-entrypoint< 8.0.38-r0
Oracle5 products
- banking_extensibility_workbench14.3.0 | 14.4.0
- blockchain_platform< 21.1.2
- enterprise_communications_broker3.1.0 | 3.2.0
- graalvmEOL19.3.2 | 20.1.0
- mysql≥ 7.3.0, ≤ 7.3.30 | ≥ 7.4.0, ≤ 7.4.29 | ≥ 7.5.0, ≤ 7.5.19 | ≥ 7.6.0, ≤ 7.6.15 | ≥ 8.0.0, ≤ 8.0.21
Alpine3 products
- nghttp2< 1.39.2-r1 | < 1.40.0-r1 | < 1.41.0-r0 | < 1.35.1-r2
- nodejs< 12.20.1-r0 | < 12.18.3-r0 | < 12.18.0-r0
- nodejs-current< 14.4.0-r0
Debian3 products
- nghttp2< 1.41.0-1
- nodejs< 10.21.0~dfsg-1
- debian_linuxEOL9.0 | 10.0
Opensuse3 products
- leapEOL15.1
- nghttp2-python&distro=openSUSE Leap 15.2< 1.40.0-lp152.2.6.1
- nghttp2&distro=openSUSE Leap 15.2< 1.40.0-lp152.2.6.1
Fedoraproject1 product
- fedoraEOL31 | 33
Mageia1 product
- nghttp2< 1.41.0-1.mga7
Nghttp21 product
- nghttp2< 1.41.0
Nodejs1 product
- node.js≥ 10.0.0, ≤ 10.12.0 | ≥ 10.13.0, < 10.21.0 | ≥ 12.0.0, ≤ 12.12.0 | ≥ 12.13.0, < 12.18.0 | ≥ 14.0.0, ≤ 14.4.0
Ubuntu1 product
- nghttp2< 1.7.1-1ubuntu0.1~esm1 | < 1.30.0-1ubuntu1+esm1 | < 1.40.0-1ubuntu0.1
12 vendors · 51 products
References
44 links
- lists.opensuse.org/opensuse-security-announce/2020-06/msg00024.htmlVendor AdvisoryAdvisoryMailing ListThird Party Advisory
- github.com/nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xrARTICLEREPORTFIXPatchThird Party Advisory
- github.com/nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090REPORTFIXPatchThird Party Advisory
- github.com/nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394REPORTFIXPatchThird Party Advisory
Show all 44 references
- lists.opensuse.org/archives/…Advisory