What’s Vulnerable › Vulnerabilities
CVE-2019-9516: Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 56.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-13 · updated 2026-06-17
- Weakness: CWE-400
Description
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Affected products
- Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
- Swift Project SwiftNIO: from 1.0.0 through 1.4.0
- Canonical Ubuntu Linux: 16.04, 18.04, 19.04
- Debian Linux: 9.0, 10.0
- nginx: from 1.9.5 before 1.16.1; from 1.17.0 through 1.17.2 — fixed in 1.16.1
- Fedoraproject Fedora: 30, 29, 32
- McAfee Web Gateway (MWG): from 7.7.2.0 before 7.7.2.24; from 7.8.2.0 before 7.8.2.13; from 8.1.0 before 8.2.0 — fixed in 7.7.2.24, 7.8.2.13, 8.2.0
- Node.js: from 8.0.0 before 8.16.1; from 10.0.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1
- openSUSE Leap: 15.0, 15.1
- Oracle Corporation GraalVM Enterprise Edition: 19.2.0
- Red Hat Enterprise Linux: 8.0
- RedHat Jboss Core Services: 1.0
- Red Hat JBoss EAP: 7.2.0, 7.3.0
- Red Hat OpenShift Service Mesh 2: 1.0
- Red Hat Quay 3: 3.0.0
- RedHat Software Collections: 1.0
- Synology DiskStation Manager: 6.2
- Synology Skynas: all versions
- Synology Vs960Hd Firmware: all versions
How to fix
Upgrade to a fixed version: nginx 1.16.1; McAfee Web Gateway (MWG) 7.7.2.24, 7.8.2.13, 8.2.0; Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://access.redhat.com/errata/RHSA-2019:2745
- https://access.redhat.com/errata/RHSA-2019:2746
- https://access.redhat.com/errata/RHSA-2019:2775
- https://access.redhat.com/errata/RHSA-2019:2799
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2946
Get alerted when CVE-2019-9516 or the next vulnerability affects your stack