What’s Vulnerable › Vulnerabilities
CVE-2019-9518: Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 25.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2019-08-13 · updated 2026-06-17
- Weakness: CWE-400
Description
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
Affected products
- Apache Software Foundation Apache Traffic Server: from 6.0.0 through 6.2.3; from 7.0.0 through 7.1.6; from 8.0.0 through 8.0.3
- Swift Project SwiftNIO: from 1.0.0 through 1.4.0
- Canonical Ubuntu Linux: 16.04, 18.04, 19.04
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 29, 30
- McAfee Web Gateway (MWG): from 7.7.2.0 before 7.7.2.24; from 7.8.2.0 before 7.8.2.13; from 8.1.0 before 8.2.0 — fixed in 7.7.2.24, 7.8.2.13, 8.2.0
- Node.js: from 8.0.0 through 8.8.1; from 8.9.0 before 8.16.1; from 10.0.0 through 10.12.0; from 10.13.0 before 10.16.3; from 12.0.0 before 12.8.1 — fixed in 10.16.3, 12.8.1, 8.16.1
- openSUSE Leap: 15.0, 15.1
- Oracle Corporation GraalVM Enterprise Edition: 19.2.0
- Red Hat Enterprise Linux: 8.0
- RedHat Jboss Core Services: 1.0
- Red Hat JBoss EAP: 7.2.0, 7.3.0
- Red Hat OpenShift Service Mesh 2: 1.0
- Red Hat Quay 3: 3.0.0
- RedHat Software Collections: 1.0
- Synology DiskStation Manager: 6.2
- Synology Skynas: all versions
- Synology Vs960Hd Firmware: all versions
How to fix
Upgrade to a fixed version: McAfee Web Gateway (MWG) 7.7.2.24, 7.8.2.13, 8.2.0; Node.js 10.16.3, 12.8.1, 8.16.1. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2019:3892
- https://access.redhat.com/errata/RHSA-2019:4352
- https://access.redhat.com/errata/RHSA-2020:0727
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://kb.cert.org/vuls/id/605641/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
Get alerted when CVE-2019-9518 or the next vulnerability affects your stack