Description

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

Remediation

References

CVE-2019-10081

Related Vulnerabilities

MySQL CVE-2012-0574 Vulnerability (CVE-2012-0574)

WordPress Plugin Responsive Owl Carousel for Elementor Local File Inclusion (1.2.0)

PHP Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2019-11045)

Liferay Portal Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2021-33320)

Joomla Exposure of Resource to Wrong Sphere Vulnerability (CVE-2020-10238)

Severity

High

Classification

CVE-2019-10081 CWE-787 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tags

Missing Update Known Vulnerabilities