Re: Cyrus HTTP/2 excessive CPU usage vulnerability

Hello Ken can you remove me from your distribution list. It's been over 10 yrs since I've been getting these emails.
Thanks

On Apr 5, 2024 4:56 AM, Ken Murchison <[email protected]> wrote:

All,
Cyrus uses libnghttp2 
for its HTTP/2 support. Recently, a vulnerability 
that can cause excessive CPU usage was found in that library.

Cyrus installations that compile with HTTP/2 support should
upgrade to libnghttp2 v1.61 immediately, or recompile Cyrus with
the --without-nghttp2 option until libnghttp2 can be upgraded.
I have verified that Cyrus compiles cleanly against v1.61+ and
interoperates fine with both iOS and Thunderbird.
-- 
Kenneth Murchison
Senior Software Developer
Fastmail US LLC

Cyrus 
/ Info / see
discussions 
+
participants 
+
delivery options 
Permalink

Cyrus
/ Info / see
discussions
+
participants
+
delivery options
Permalink