CVE-2020-11080: Nghttp2 HTTP/2 SETTINGS Frame DoS Flaw

CVE-2020-11080 Overview

CVE-2020-11080 is a denial of service vulnerability in nghttp2, a popular HTTP/2 C library. The vulnerability exists because nghttp2 improperly handles overly large HTTP/2 SETTINGS frame payloads, allowing a malicious client to cause complete CPU exhaustion on affected systems. This affects a wide range of products that incorporate the nghttp2 library, including Node.js, Oracle MySQL, and various Linux distributions.

Critical Impact

A remote, unauthenticated attacker can cause complete denial of service by sending specially crafted HTTP/2 SETTINGS frames, causing the target server's CPU to spike to 100% utilization.

Affected Products

• nghttp2 versions before 1.41.0
• Node.js (multiple versions)
• Debian Linux 9.0 and 10.0
• openSUSE Leap 15.1
• Fedora 31 and 33
• Oracle MySQL (multiple versions)
• Oracle GraalVM 19.3.2 and 20.1.0
• Oracle Banking Extensibility Workbench 14.3.0 and 14.4.0
• Oracle Blockchain Platform
• Oracle Enterprise Communications Broker 3.1.0 and 3.2.0

Discovery Timeline

• June 3, 2020 - CVE-2020-11080 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-11080

Vulnerability Analysis

This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-707 (Improper Neutralization). The flaw resides in how nghttp2 processes incoming HTTP/2 SETTINGS frames without adequate limitations on the number of settings entries that can be included in a single frame.

HTTP/2 SETTINGS frames are used to communicate configuration parameters between endpoints. Each settings entry consists of a 16-bit identifier and a 32-bit value, totaling 6 bytes per entry. The HTTP/2 specification allows multiple settings entries within a single frame, but nghttp2 failed to impose reasonable limits on the quantity of entries it would process.

The vulnerability can be exploited remotely over the network without requiring any authentication or user interaction. The impact is limited to availability—there is no confidentiality or integrity impact. However, successful exploitation results in complete denial of service for the affected system.

Root Cause

The root cause of this vulnerability is the absence of input validation on the number of settings entries within an HTTP/2 SETTINGS frame. The nghttp2 library would process arbitrarily large SETTINGS frames without checking if the number of entries exceeded a reasonable threshold. This allowed attackers to craft frames with thousands of settings entries, each requiring CPU cycles to parse and process.

The proof of concept demonstrates that a SETTINGS frame payload of 14,400 bytes containing 2,400 individual settings entries, when sent repeatedly, causes the CPU to spike to 100% utilization. The library's frame processing loop would consume excessive computational resources attempting to handle these malformed frames.

Attack Vector

The attack requires network access to a service using the vulnerable nghttp2 library for HTTP/2 communication. A malicious client establishes an HTTP/2 connection to the target server and repeatedly sends SETTINGS frames with an abnormally high number of settings entries.

The attack mechanism works as follows: the attacker constructs an HTTP/2 SETTINGS frame with 2,400 settings entries (14,400 bytes). This frame is sent continuously to the target. The server's nghttp2 library processes each entry, consuming CPU resources. With sustained transmission, the server's CPU reaches 100% utilization, effectively denying service to legitimate users.

This attack is particularly dangerous because it requires minimal bandwidth from the attacker while causing maximum impact on the target system. The attack can be sustained with relatively little effort, making it an effective denial of service vector.

Detection Methods for CVE-2020-11080

Indicators of Compromise

• Unusual CPU spikes to 100% utilization on servers handling HTTP/2 traffic
• High volume of HTTP/2 SETTINGS frames from a single source IP address
• SETTINGS frames with payload sizes significantly larger than typical (normal frames contain few entries, malicious frames contain thousands)
• Connection patterns showing repeated SETTINGS frame transmissions without normal HTTP/2 request/response activity

Detection Strategies

• Monitor HTTP/2 traffic for SETTINGS frames with unusually large payloads (frames exceeding 192 bytes, which would contain more than 32 entries)
• Implement network intrusion detection rules to alert on HTTP/2 connections that send multiple large SETTINGS frames in succession
• Deploy application-layer firewalls capable of inspecting HTTP/2 frame content and blocking oversized SETTINGS frames
• Use process monitoring to detect sudden CPU spikes correlated with HTTP/2 service processes

Monitoring Recommendations

• Configure alerting for CPU utilization exceeding normal thresholds on HTTP/2-enabled services
• Implement connection rate limiting for clients sending excessive SETTINGS frames
• Log and analyze HTTP/2 frame metadata to identify anomalous traffic patterns
• Monitor nghttp2 library version across all deployed applications to ensure patched versions are in use

How to Mitigate CVE-2020-11080

Immediate Actions Required

• Update nghttp2 to version 1.41.0 or later immediately across all affected systems
• Apply vendor-specific patches for downstream products including Node.js, Oracle products, and Linux distributions
• If immediate patching is not possible, implement the callback-based workaround described below
• Review firewall rules to limit exposure of HTTP/2 services to trusted networks where feasible

Patch Information

The nghttp2 project released version 1.41.0 to address this vulnerability. The fix introduces validation to limit the number of SETTINGS entries processed per frame. Patches are available through the GitHub Security Advisory and via the official commit references.

Multiple downstream vendors have also released patches:

• Debian Security Advisory DSA-4696
• Oracle CPU July 2020 and subsequent quarterly updates
• Fedora Package Announcements for Fedora 31 and 33

Workarounds

• Implement the nghttp2_on_frame_recv_callback callback in your application code
• Within the callback, check if the received frame is a SETTINGS frame
• If the number of settings entries exceeds a threshold (recommended: greater than 32), drop the connection immediately
• Consider deploying a reverse proxy with HTTP/2 frame inspection capabilities in front of vulnerable services as an interim measure

# Example: Verify nghttp2 version on Linux systems
# Check if vulnerable version is installed
dpkg -l | grep libnghttp2
# or for RPM-based systems
rpm -qa | grep nghttp2

# Update nghttp2 on Debian/Ubuntu
sudo apt-get update && sudo apt-get upgrade libnghttp2-14

# Update on RHEL/CentOS/Fedora
sudo dnf update nghttp2