The Imperva HTTP/2 Vulnerability Report and NGINX
The Imperva HTTP/2 Vulnerability Report and NGINX On Thursday, August 4th, Imperva – an Internet security company – announced four potential security vulnerabilities in the HTTP/2 protocol, and issued a detailed report evaluating a number of webservers against these vulnerabilities. NGINX 1.9.9 performed comparatively well in Imperva’s tests, and was not affected by three of the four potential vulnerabilities. Attempts to exploit the remaining vulnerability, “Slow Read”, caused a resource leakage in NGINX and ultimately allowed a denial-of-service attack against HTTP/2 services. Vulnerabilities exposed in leading webservers (from the Imperva report) The fault was reported to NGINX, and was resolved promptly in the NGINX 1.9.12 and NGINX Plus R9 releases. We are pleased to confirm that none of the current versions of NGINX – NGINX Plus, NGINX ‘mainline’, NGINX ‘stable’ – are vulnerable to any of the potential attacks described [ more… ]
