What’s Vulnerable › Vulnerabilities

CVE-2019-9512: Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 83.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-08-13 · updated 2026-06-17
• Weakness: CWE-400

Description

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected products

• Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
• Swift Project SwiftNIO: from 1.0.0 through 1.4.0
• Debian Linux: 10.0
• Node.js: from 8.0.0 through 8.8.1; from 8.9.0 before 8.16.1; from 10.0.0 through 10.12.0; from 10.13.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1

How to fix

Upgrade to a fixed version: Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
• http://seclists.org/fulldisclosure/2019/Aug/16
• http://www.openwall.com/lists/oss-security/2019/08/20/1
• https://access.redhat.com/errata/RHSA-2019:2594
• https://access.redhat.com/errata/RHSA-2019:2661
• https://access.redhat.com/errata/RHSA-2019:2682

Get alerted when CVE-2019-9512 or the next vulnerability affects your stack