What’s Vulnerable › Vulnerabilities
CVE-2019-9517: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 27.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-13 · updated 2026-06-17
- Weakness: CWE-400
Description
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
Affected products
- Apache HTTP Server: from 2.4.20 before 2.4.40 — fixed in 2.4.40
- Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
- Swift Project SwiftNIO: from 1.0.0 through 1.4.0
- Canonical Ubuntu Linux: 16.04, 18.04, 19.04
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 29, 30
- McAfee Web Gateway (MWG): from 7.7.2.0 before 7.7.2.24; from 7.8.2.0 before 7.8.2.13; from 8.1.0 before 8.2.0 — fixed in 7.7.2.24, 7.8.2.13, 8.2.0
- Clustered Data ONTAP: all versions
- Node.js: from 8.0.0 through 8.8.1; from 8.9.0 before 8.16.1; from 10.0.0 through 10.12.0; from 10.13.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1
- openSUSE Leap: 15.0, 15.1
- Oracle Communications Element Manager: 8.0.0, 8.1.0, 8.1.1, 8.2.0
- Oracle Corporation GraalVM Enterprise Edition: 19.2.0
- Oracle Instantis Enterprisetrack: from 17.1 through 17.3
- Oracle Corporation Retail Xstore Point of Service: 7.1
- Red Hat Enterprise Linux: 8.0
- RedHat Jboss Core Services: 1.0
- Red Hat JBoss EAP: 7.2.0, 7.3.0
- Red Hat OpenShift Service Mesh 2: 1.0
- Red Hat Quay 3: 3.0.0
- RedHat Software Collections: 1.0
- Synology DiskStation Manager: 6.2
- Synology Skynas: all versions
- Synology Vs960Hd Firmware: all versions
How to fix
Upgrade to a fixed version: Apache HTTP Server 2.4.40; McAfee Web Gateway (MWG) 7.7.2.24, 7.8.2.13, 8.2.0; Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://www.openwall.com/lists/oss-security/2019/08/15/7
- https://access.redhat.com/errata/RHSA-2019:2893
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2946
- https://access.redhat.com/errata/RHSA-2019:2949
- https://access.redhat.com/errata/RHSA-2019:2950
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2019:3932
Get alerted when CVE-2019-9517 or the next vulnerability affects your stack