What’s Vulnerable › Vulnerabilities
CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 82.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-13 · updated 2026-06-17
- Weakness: CWE-400
Description
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Affected products
- Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
- Swift Project SwiftNIO: from 1.0.0 through 1.4.0
- Canonical Ubuntu Linux: 16.04, 18.04, 19.04
- Debian Linux: 10.0, 9.0
- F5 BIG-IP (LTM): from 11.6.1 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.0 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
- Fedoraproject Fedora: 29, 30
- McAfee Web Gateway (MWG): from 7.7.2.0 before 7.7.2.24; from 7.8.2.0 before 7.8.2.13; from 8.1.0 before 8.2.0 — fixed in 7.7.2.24, 7.8.2.13, 8.2.0
- NetApp Cloud Insights: all versions
- NetApp Trident: all versions
- Node.js: from 8.0.0 through 8.8.1; from 8.9.0 before 8.16.1; from 10.0.0 through 10.12.0; from 10.13.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1
- openSUSE Leap: 15.0, 15.1
- Oracle Corporation GraalVM Enterprise Edition: 19.2.0
- RedHat Developer Tools: 1.0
- Red Hat Enterprise Linux: 8.0
- RedHat Enterprise Linux Eus: 8.1
- RedHat Enterprise Linux Server: 7.0
- RedHat Enterprise Linux Workstation: 7.0
- RedHat Jboss Core Services: 1.0
- Red Hat JBoss EAP: 7.2.0, 7.3.0
- Red Hat OpenShift Container Platform 4.18: 3.9, 3.10, 3.11, 4.1, 4.2
- Red Hat OpenShift Service Mesh 2: 1.0
- OpenStack: 14
- Red Hat Quay 3: 3.0.0
- Red Hat Single Sign-On: 7.3
- RedHat Software Collections: 1.0
- Synology DiskStation Manager: 6.2
- Synology Skynas: all versions
- Synology Vs960Hd Firmware: all versions
How to fix
Upgrade to a fixed version: F5 BIG-IP (LTM) 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; McAfee Web Gateway (MWG) 7.7.2.24, 7.8.2.13, 8.2.0; Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
- http://seclists.org/fulldisclosure/2019/Aug/16
- http://www.openwall.com/lists/oss-security/2019/08/20/1
- http://www.openwall.com/lists/oss-security/2023/10/18/8
- https://access.redhat.com/errata/RHSA-2019:2594
- https://access.redhat.com/errata/RHSA-2019:2661
Get alerted when CVE-2019-9514 or the next vulnerability affects your stack