Yu Lu

The issue is related to errors in the resource consumption control mechanism of the HTTP/2 protocol implementation in various software products. An attacker can exploit this by sending a stream of SETTINGS frames, potentially leading to a denial of service due to excessive CPU or memory consumption. The vulnerability can be exploited by continually sending data, causing affected components to consume large amounts of memory and potentially leading to an out-of-memory condition.

The issue is related to an HTTP request splitting vulnerability in Twisted Web. When a content-length and a chunked encoding header are present, the content-length takes precedence, and the remainder of the request body is interpreted as a pipelined request. This vulnerability is associated with insufficient input validation when processing HTTP headers, which could allow a remote attacker to cause a denial of service.