GHSA-32gv-6cf3-wcmq
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
Details
### Impact Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:
Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512 Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515
A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).
### Workarounds There are no workarounds.
### References https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
### For more information If you have any questions or comments about this advisory: * Open an issue in [Twisted's Trac](https://twistedmatrix.com/trac/)
Are you affected?
Enter the version of the package you're using.