Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-11080

21
FAUCET Score

CVE-2020-11080 describes a denial-of-service vulnerability in nghttp2 versions prior to 1.41.0, affecting products like Debian, Fedora, Node.js, and Oracle. A remote, unauthenticated attacker can exploit this by sending an oversized HTTP/2 SETTINGS frame, causing the CPU to spike to 100%. This high-severity vulnerability (CVSS 7.5) is easily exploitable with low attack complexity and no user interaction, leading to a complete loss of availability. There is no evidence of active exploitation, public exploit code, or significant community discussion, though a fix is available in nghttp2 v1.41.0 and a workaround exists.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.41.0CPE matchmatch criteria
cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
10.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
15.1CPE matchmatch criteria
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
31CPE matchmatch criteria
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

3.7LOW

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
LOW
Exploitability Score
2.2
Impact Score
1.4
CvssVersion
3.1

Exploit Intelligence

EPSS Score
5.32%
Probability of exploitation in next 30 days
EPSS Percentile
91.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0532 is in the 86th percentile among its peer group of 51,485 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (44)

github_advisorypatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: 19181-16820Fixed in: 1.41.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 x64Fixed in: 1.41.0-1
microsoftpatch availablevia msrc
Product: CBL Mariner 1.0 ARMFixed in: 1.41.0-1
microsoftpatch availablevia msrc
Product: cm1 nghttp2 1.41.0-1 on CBL Mariner 1.0Fixed in: 1.41.0-1
oraclepatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_md-1:2.0.8-24.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_security-0:2.9.2-51.GA.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-nghttp2-0:1.39.2-25.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-curl-0:7.64.1-36.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.14-4.Final_redhat_2.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_http2-0:1.15.7-3.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.48-4.redhat_1.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_md-1:2.0.8-24.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_security-0:2.9.2-51.GA.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.39.2-25.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-pkcs11-0:0.4.10-7.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: OpenShift Service Mesh 1.0Fixed in: servicemesh-proxy-0:1.0.10-3.el8
View patch
redhatpatch availablevia redhat_api
Product: OpenShift Service Mesh 1.1Fixed in: servicemesh-proxy-0:1.1.2-3.el8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: nodejs:10-8020020200617141353.4cda2c84
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: nodejs:12-8020020200630155331.4cda2c84
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: nghttp2-0:1.33.0-3.el8_2.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.0 Update Services for SAP SolutionsFixed in: nodejs:10-8000020200617115915.f8e95b4e
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.0 Update Services for SAP SolutionsFixed in: nghttp2-0:1.33.0-1.el8_0.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: nodejs:12-8010020200630154708.c27ad7f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: nodejs:10-8010020200617134056.c27ad7f8
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.1 Extended Update SupportFixed in: nghttp2-0:1.33.0-3.el8_1.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: httpd24-nghttp2-0:1.7.1-8.el6.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: httpd24-nghttp2-0:1.7.1-8.el7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs12-nodejs-0:12.18.2-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nodejs10-nodejs-0:10.21.0-3.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: httpd24-nghttp2-0:1.7.1-8.el7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs12-nodejs-0:12.18.2-1.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nodejs10-nodejs-0:10.21.0-3.el7
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: httpd24-nghttp2-0:1.7.1-8.el7.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs10-nodejs-0:10.21.0-3.el7
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCS
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.7 EUSFixed in: rh-nodejs12-nodejs-0:12.18.2-1.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-curl-0:7.64.1-36.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.37-57.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.14-4.Final_redhat_2.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_http2-0:1.15.7-3.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_jk-0:1.2.48-4.redhat_1.jbcs.el6
View patch

Vendor Advisories (3)

microsoft2020-Aug/CVE-2020-11080

CVE-2020-11080

Aug 11, 2020
microsoft2020-Jun/CVE-2020-11080Important

Denial of service in nghttp2

Jun 9, 2020
redhatCVE-2020-11080Important

nghttp2: overly large SETTINGS frames can lead to DoS

Jun 2, 2020

References

lists.opensuse.org / opensuse-security-announce/2020-06/msg00024.html
Mailing ListThird Party Advisory
github.com / nghttp2/nghttp2/commit/336a98feb0d56b9ac54e12736b18785c27f75090
PatchThird Party Advisory
github.com / nghttp2/nghttp2/commit/f8da73bd042f810f34d19f9eae02b46d870af394
PatchThird Party Advisory
github.com / nghttp2/nghttp2/security/advisories/GHSA-q5wr-xfw9-q7xr
PatchThird Party Advisory
lists.debian.org / debian-lts-announce/2021/10/msg00011.html
Mailing ListThird Party Advisory
lists.debian.org / debian-lts-announce/2023/10/msg00023.html
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6
lists.fedoraproject.org / archives/list/package-announce%40lists.fedoraproject.org/message/AAC2AA36OTRHKSVM5OV7TTVB3CZIGEFL
debian.org / security/2020/dsa-4696
Third Party Advisory
oracle.com / security-alerts/cpuapr2022.html
PatchThird Party Advisory
oracle.com / security-alerts/cpujan2021.html
Third Party Advisory
oracle.com / security-alerts/cpujul2020.html
Third Party Advisory
oracle.com / /security-alerts/cpujul2021.html
Not ApplicableThird Party Advisory
oracle.com / security-alerts/cpuoct2020.html
Third Party Advisory