CRUX HTTP/2 Remote DoS (v1.13) Vulnerability & Fix Summary

CRUX / Protocol-HTTP2 Vulnerability Key Information Summary Vulnerability Overview Vulnerability Type: Remote Denial of Service (DoS) Reporter: Robert Rothenberg (CAPS Security Group) Fixed Version: 1.14 (2026-09-03T10:30Z) Scope of Impact Affected Versions: 1.13 and earlier Impact Description: - 1.13 (2026-06-10T25:10Z): Remote Denial of Service vulnerability - 1.12 (2026-02-16T12:55:50Z): - flag not properly synchronized within CONTINUATION frames - Received CONTINUATION frames overwrite the existing header buffer - Fix: Testing CONTINUATION frame handling - 1.11 (2024-05-10T16:55:28Z): - Fixed typos (Yoshikazu Sawa) - No longer deprecated and disabled on specific systems (Olivier Gayot) - Fixed warnings in Perl 5.12 (Felipe Gaspar) - 1.10 (2019-11-12T06:19:06Z): Fixed test 9 (Issue #8) - 1.09 (2018-08-08T10:30:00Z): - Fixed typos (Gregor Herrmann) - Added link to RFC 7540 (Mohammad S Anwar) - Fixed warning for the callback (Felipe Gaspar) - Fixed uninitialized warning (Junho Choi) - 1.08 (2016-09-27T12:57:02Z): - Implemented callback for requests - Fixed synchronization handling for frame (thanks to Dmitriy Bondarev) - Fix: Last chunk of data could be sent multiple times - Updated using current values - 1.07 (2016-03-03T28:45:02Z): - Implemented method for client and server - Implemented trailer header support - Fixed some error codes - Improved header table handling - 1.06 (2015-02-22T08:56:19Z): - Implemented option for client (#1) - Implemented explicit connection close for client (#3) - Fixed constant value (thanks to Francisco Orisopo) - Fixed tests - 1.05 (2015-12-24T12:48:10Z): - Supported for request bodies - Fixed bug: Chrome sends as a literal; created an exception for empty values in pseudo-headers - New client stream handling, request cancellation - 1.04 (2015-08-09T12:59:58Z): - Reimplemented method (thanks to Dmitriy Bondarev) - Return error for frames - Check the length of frames - Implemented and - Fix: Stream control window initialized with incorrect values when sending frames - Fix: Low window lock on empty streams - Strict header validation - Check explicit content-length header to match received DATA frame size - Control maximum concurrent streams - Fixed tests - 1.02 (2015-06-22T12:17:54Z): - Fixed errors in server/client code - New test to check warnings - Updated examples to use TLS - 1.00 (2015-05-06T15:51:09Z): - Updated protocol to strings ("h2", "h2c"), removed inline id strings - HTTP/2 to RFC 7540 - HPACK to RFC 7541 - Updated protocol to draft 12 - 0.12 (2015-04-05T02:41:09Z): - Updated status (beta) - Added wiki link - Implemented server stream handling - Implemented client download, request cancellation - 0.10 (2015-02-20T20:39:20Z): - Added setting to server/client constructors - Allowed setting custom configurations in server/client constructors - Fixed bug: Settings packing/unpacking - Fix: flag replaced by - Settings from 8-bit to 16-bit unsigned integers - Updated Huffman code table - Updated static table - 0.14 (2015-02-11T13:01:22Z): - Updated HTTP/2 to draft 17 - Updated HPACK to draft 11 - 0.13 (2014-12-03T07:58:43Z): - Updated HTTP/2 to draft 16 - Added draft_interop version (14) for interoperability - 0.12 (2014-10-18T10:18:22Z): - Updated HTTP/2 to draft 15 - 0.11 (2014-08-14T12:07:48Z): - Removed requirement - Fixed - Fixed tests - 0.10 (2014-07-31T21:25:59Z): - Updated HPACK to draft 14 - Updated HPACK to draft 09 - Fixed tests - 0.09 (2014-07-08T13:16:24Z): - Another fix to (checking functionality) - Updated extract script - Updated status to draft 13 - Removed and states - Removed frame compression support - Updated: , flags replaced by - Settings from 8-bit to 16-bit unsigned integers - Updated Huffman code table - Updated static table - 0.08 (2014-05-17T09:59:09Z): - Fixed test - Fixed constant - Fixed blocking data sending - Allowed zero-size DATA frames - Fixed HPACK encoding: cancellation and reference set clearing - Added protocol: server P00 - Fixed upgrade (added required parameter: scheme) - 0.07 (2014-05-15T13:14:32Z): - Implemented encoder/decoder - Implemented encoder (priority handling) - Removed old flags , , , - Added TCP tests - Updated (TCP/test and other test dependencies) - Implemented encoder/decoder - Updated protocol: HTTP/2 P00 - Added protocol: HTTP/2 client P00 - 0.06 (2014-05-13T17:51:58Z): - Switched to - Implemented encoder/decoder - Implemented : unmapped state operations - Internal test module - Implemented encoder - Fixed tests - Added server to server example - State handling: enqueue after encoding frames - 0.05 (2014-05-11T11:19:57Z): - Implemented flow control - Implemented encoder/decoder - Fixed constant - Fixed runtime error: - Required MIME: ( and ) - HTTP/2.1 upgraded to client - 0.04 (2014-05-08T10:32:42Z): - Updated server example - Implemented HTTP/1.1 upgrade (server) - Fixed build error: - Updated ( for NPM) - Updated status documentation - 0.03 (2014-05-05T05:50:50Z): - Client supports NPN/ALPN and server handli

Goal Reached Thanks to every supporter — we hit 100%!

CRUX HTTP/2 Remote DoS (v1.13) Vulnerability & Fix Summary