What’s Vulnerable › Vulnerabilities

CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 59.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-08-13 · updated 2026-06-17
• Weakness: CWE-400

Description

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected products

• Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
• Swift Project SwiftNIO: from 1.0.0 through 1.4.0
• Canonical Ubuntu Linux: 16.04, 18.04, 19.04
• Debian Linux: 9.0, 10.0
• nginx: from 1.9.5 before 1.16.1; from 1.17.0 through 1.17.2 — fixed in 1.16.1
• Fedoraproject Fedora: 29, 30
• McAfee Web Gateway (MWG): from 7.7.2.0 before 7.7.2.24; from 7.8.2.0 before 7.8.2.13; from 8.1.0 before 8.2.0 — fixed in 7.7.2.24, 7.8.2.13, 8.2.0
• Node.js: from 8.0.0 through 8.8.1; from 8.9.0 before 8.16.1; from 10.0.0 through 10.12.0; from 10.13.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1
• openSUSE Leap: 15.0, 15.1
• Oracle Corporation Enterprise Communications Broker: 3.1.0, 3.2.0
• Oracle Corporation GraalVM Enterprise Edition: 19.2.0
• Red Hat Enterprise Linux: 8.0
• RedHat Jboss Core Services: 1.0
• Red Hat JBoss EAP: 7.2.0, 7.3.0
• Red Hat OpenShift Service Mesh 2: 1.0
• Red Hat Quay 3: 3.0.0
• RedHat Software Collections: 1.0
• Synology DiskStation Manager: 6.2
• Synology Skynas: all versions
• Synology Vs960Hd Firmware: all versions

How to fix

Upgrade to a fixed version: nginx 1.16.1; McAfee Web Gateway (MWG) 7.7.2.24, 7.8.2.13, 8.2.0; Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
• https://access.redhat.com/errata/RHSA-2019:2692
• https://access.redhat.com/errata/RHSA-2019:2745
• https://access.redhat.com/errata/RHSA-2019:2746
• https://access.redhat.com/errata/RHSA-2019:2775
• https://access.redhat.com/errata/RHSA-2019:2799
• https://access.redhat.com/errata/RHSA-2019:2925

Get alerted when CVE-2019-9511 or the next vulnerability affects your stack