CVE-2019-9515: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 87.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-13 · updated 2026-06-17
Weakness: CWE-400

Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected products

Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
Swift Project SwiftNIO: from 1.0.0 through 1.4.0
Canonical Ubuntu Linux: 16.04, 18.04, 19.04
Debian Linux: 9.0, 10.0
F5 BIG-IP (LTM): from 11.6.1 before 11.6.5.1; from 12.1.0 before 12.1.5.1; from 13.1.0 before 13.1.3.2; from 14.0.0 before 14.0.1.1; from 14.1.0 before 14.1.2.1; from 15.0.0 before 15.0.1.1 — fixed in 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
Fedoraproject Fedora: 29, 30
McAfee Web Gateway (MWG): from 7.7.2.0 before 7.7.2.24; from 7.8.2.0 before 7.8.2.13; from 8.1.0 before 8.2.0 — fixed in 7.7.2.24, 7.8.2.13, 8.2.0
Node.js: from 8.0.0 through 8.8.1; from 8.9.0 before 8.16.1; from 10.0.0 through 10.12.0; from 10.13.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1
openSUSE Leap: 15.0, 15.1
Oracle Corporation GraalVM Enterprise Edition: 19.2.0
Red Hat Enterprise Linux: 8.0
RedHat Jboss Core Services: 1.0
Red Hat JBoss EAP: 7.2.0, 7.3.0
Red Hat OpenShift Container Platform 4.18: 4.1
Red Hat OpenShift Service Mesh 2: 1.0
OpenStack: 14
Red Hat Quay 3: 3.0.0
Red Hat Single Sign-On: 7.3
RedHat Software Collections: 1.0
Synology DiskStation Manager: 6.2
Synology Skynas: all versions
Synology Vs960Hd Firmware: all versions

How to fix

Upgrade to a fixed version: F5 BIG-IP (LTM) 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1; McAfee Web Gateway (MWG) 7.7.2.24, 7.8.2.13, 8.2.0; Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-9515 or the next vulnerability affects your stack