MGASA-2020-0256

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2020-11080
Published: 10 Jun 2020, 23:59
Last modified:16 Apr 2026, 04:25

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Jun 2020, 23:59
Published
Vulnerability first disclosed
16 Apr 2026, 04:25
Last Modified
Vulnerability information updated

Description

Updated nghttp2 packages fix security vulnerability nghttp2 has been updated to version 1.41.0 to fix CVE-2020-11080. The overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%.

Affected Systems

  • mageia•nghttp2

    < 1.41.0-1.mga7

References (2)