HTTP2 SETTINGS FRAME Denial of Service

jbiskofski jbiskofski at
Sun Apr 19 16:04:45 UTC 2020

Hello everyone.

I need to pass a security audit, For a PCI compliance process.

A scan was performed on my servers and found a vulnerability in nginx
"HTTP2 SETTINGS FRAME Denial of Service"

I upgraded nginx to the latest stable 1.16.1 which supposedly fixes that
issue. see :

But the security scan is still reporting the same problem.
The scan report ends with - "technical details : sent HTTP2 request with 20
SETTINGS and received a valid response"

I do have http2 enabled, and need it to stay enabled.

Can someone please point me in the right direction about how to fix this. I
have a few questions.
Can I disable that "20 SETTINGS" request somehow?
Will that mess up my http2 connections?
Is there some other solution?
Should I try to update to mainline?

Here is the output of my nginx -V

nginx version: nginx/1.16.1
built by clang 6.0.0 (tags/RELEASE_600/final 326565) (based on LLVM 6.0.0)
built with OpenSSL 1.0.2o-freebsd  27 Mar 2018
TLS SNI support enabled
configure arguments: --prefix=/usr/local/nginx --with-http_ssl_module


- Jose
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the nginx mailing list