CVEvulnerability

CVE-2019-9511

7.5 HIGH Published 2019-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-400, CWE-770

Description

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected configurations

• apple swiftnio (>= 1.0.0 <= 1.4.0) • apache traffic server (>= 6.0.0 <= 6.2.3) • apache traffic server (>= 7.0.0 <= 7.1.6) • apache traffic server (>= 8.0.0 <= 8.0.3) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • debian debian linux 9.0 • debian debian linux 10.0 • synology skynas • synology diskstation manager 6.2 • synology vs960hd firmware • fedoraproject fedora 29 • fedoraproject fedora 30 • opensuse leap 15.0 • opensuse leap 15.1 • redhat jboss core services 1.0 • redhat jboss enterprise application platform 7.2.0 • redhat jboss enterprise application platform 7.3.0 • redhat openshift service mesh 1.0 • redhat quay 3.0.0 • redhat software collections 1.0 • redhat enterprise linux 8.0 • oracle graalvm 19.2.0 • mcafee web gateway (>= 7.7.2.0 < 7.7.2.24) • mcafee web gateway (>= 7.8.2.0 < 7.8.2.13) • mcafee web gateway (>= 8.1.0 < 8.2.0) • f5 nginx (>= 1.9.5 < 1.16.1) • f5 nginx (>= 1.17.0 <= 1.17.2) • oracle enterprise communications broker 3.1.0 • oracle enterprise communications broker 3.2.0 • nodejs node.js (>= 8.0.0 <= 8.8.1) • nodejs node.js (>= 8.9.0 < 8.16.1) • nodejs node.js (>= 10.0.0 <= 10.12.0) • nodejs node.js (>= 10.13.0 < 10.16.3) • nodejs node.js (>= 12.0.0 < 12.8.1)

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References