{"action":"closed","issue":{"url":"https://api.github.com/repos/pgjones/quart/issues/28","repository_url":"https://api.github.com/repos/pgjones/quart","labels_url":"https://api.github.com/repos/pgjones/quart/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/pgjones/quart/issues/28/comments","events_url":"https://api.github.com/repos/pgjones/quart/issues/28/events","html_url":"https://github.com/pgjones/quart/issues/28","id":351885787,"node_id":"MDU6SXNzdWUzNTE4ODU3ODc=","number":28,"title":"HTTP/2 DoS Vulnerability","user":{"login":"GalGoldshtein","id":42509489,"node_id":"MDQ6VXNlcjQyNTA5NDg5","avatar_url":"https://avatars2.githubusercontent.com/u/42509489?v=4","gravatar_id":"","url":"https://api.github.com/users/GalGoldshtein","html_url":"https://github.com/GalGoldshtein","followers_url":"https://api.github.com/users/GalGoldshtein/followers","following_url":"https://api.github.com/users/GalGoldshtein/following{/other_user}","gists_url":"https://api.github.com/users/GalGoldshtein/gists{/gist_id}","starred_url":"https://api.github.com/users/GalGoldshtein/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GalGoldshtein/subscriptions","organizations_url":"https://api.github.com/users/GalGoldshtein/orgs","repos_url":"https://api.github.com/users/GalGoldshtein/repos","events_url":"https://api.github.com/users/GalGoldshtein/events{/privacy}","received_events_url":"https://api.github.com/users/GalGoldshtein/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-08-19T08:44:28Z","updated_at":"2018-09-02T08:36:51Z","closed_at":"2018-09-02T08:36:51Z","author_association":"NONE","body":"Hi,\r\n\r\nI would like to report a vulnerability in quart HTTP Server when serving HTTP/2 clients.\r\n\r\nIn section 10.5 of the HTTP/2 RFC an attack is described where an attacker is sending large SETTINGS frames that includes many settings inside it. \r\nWe tested this scenario by opening many connections to the quart server and sending a SETTINGS frame with payload size of 14400 bytes and we were able to cause quart to consume all the machines memory and overload one CPU core with 100% usage by attacking from a single machine. \r\n\r\nIt is also important to note that quart never closes the connection so the attacker can keep sending those malformed SETTINGS frames, and when under the attack described above, quart responds after a long period to new legitimate requests:\r\n\r\n![image](https://user-images.githubusercontent.com/42509489/44307065-a8fe4400-a3a4-11e8-9f0f-d0a9430ae616.png)\r\n\r\n![image](https://user-images.githubusercontent.com/42509489/44307098-245ff580-a3a5-11e8-9d13-bd7a9dfca267.png)\r\n\r\nYou can find the script that we used for attacking it and the script that was used to start the server instance in the following link: https://galgoldshtein.co.il/HTTP2/62c31461558c9be64089145736d0d5bf/HTTP2%20Settings%20Frame%20DoS.zip\r\n\r\nThanks.\r\n\r\n"}}
{"actor":{"display_login":"pgjones"}}