CVE-2016-7153

The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote…

published September 6, 2016

CVSS

—

EPSS

13%

Percentile

96.2

In the wild

Unconfirmed

What it is

The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.

The record

Technical detail

CVSS: Not scored
CVSS v4.0: Not supplied
EPSS: 0.12766 · 96.2th percentile
Published: 2016-09-06T10:00Z

EPSS history

Timeline

06 SEP 10:00Z
The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote…
cvelistv5