From: "Cygwin nghttp2 Maintainer" <Brian.Inglis@Shaw.ca>
To: "Cygwin Announcements" <cygwin-announce@cygwin.com>
Subject: Updated: mingw64-x86_64-/nghttp2 libnghttp2_14/-devel 1.57
Date: Fri, 13 Oct 2023 16:27:16 -0600 [thread overview]
Message-ID: <20231013162716.25990-1-Brian.Inglis@Shaw.ca> (raw)
The following packages have been upgraded in the Cygwin distribution:
* nghttp2 1.57
* libnghttp2_14 1.57
* libnghttp2-devel 1.57
* mingw64-x86_64-nghttp2 1.57
HTTP/2 and its header compression algorithm HPACK implementation.
The framing layer of HTTP/2 is implemented as a reusable library.
Also included are an HTTP/2 client, server, proxy, load test and
benchmarking tool.
NOTE:
Support for previously deprecated Python bindings, modules, and
documentation was dropped some releases ago.
For more information see the project home page:
https://nghttp2.org/
or the repo README:
https://github.com/nghttp2/nghttp2#readme
See link or text below for recent changes; after installation for
complete details of changes read /usr/share/doc/nghttp2/ChangeLog.
https://nghttp2.org/blog/
2023-10-10 1.57.0
Security Advisory CVE-2023-44487 HTTP/2 Rapid Reset
For more information, read the security advisory:
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg
lib
This release has a fix to mitigate CVE-2023-44487: HTTP/2 Rapid Reset.
It has reasonable amount of default budgets for incoming RST_STREAM frames.
Application can tune the rate limit by using
nghttp2_option_set_stream_reset_rate_limit.
It can also implement its own rate limit by implementing
nghttp2_on_frame_recv_callback and check RST_STREAM frame.
nghttpx
This release fixes the bug that --single-process does not work.
It also fixes the bug that TLS connection is not rate limited.
reply other threads:[~2023-10-13 22:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20231013162716.25990-1-Brian.Inglis@Shaw.ca \
--to=brian.inglis@shaw.ca \
--cc=cygwin-announce@cygwin.com \
--cc=cygwin@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).