CVEvulnerability

CVE-2019-9513

7.5 HIGH Published 2019-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-400

Description

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Affected configurations

• apple swiftnio (>= 1.0.0 <= 1.4.0) • apache traffic server (>= 6.0.0 <= 6.2.3) • apache traffic server (>= 7.0.0 <= 7.1.6) • apache traffic server (>= 8.0.0 <= 8.0.3) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • debian debian linux 9.0 • debian debian linux 10.0 • fedoraproject fedora 30 • synology skynas • synology diskstation manager 6.2 • synology vs960hd firmware • fedoraproject fedora 29 • opensuse leap 15.0 • opensuse leap 15.1 • redhat jboss core services 1.0 • redhat jboss enterprise application platform 7.2.0 • redhat jboss enterprise application platform 7.3.0 • redhat openshift service mesh 1.0 • redhat quay 3.0.0 • redhat software collections 1.0 • redhat enterprise linux 8.0 • oracle graalvm 19.2.0 • mcafee web gateway (>= 7.7.2.0 < 7.7.2.24) • mcafee web gateway (>= 7.8.2.0 < 7.8.2.13) • mcafee web gateway (>= 8.1.0 < 8.2.0) • f5 nginx (>= 1.9.5 < 1.16.1) • f5 nginx (>= 1.17.0 <= 1.17.2) • oracle enterprise communications broker 3.1.0 • oracle enterprise communications broker 3.2.0 • nodejs node.js (>= 8.0.0 <= 8.8.1) • nodejs node.js (>= 8.9.0 < 8.16.1) • nodejs node.js (>= 10.0.0 <= 10.12.0) • nodejs node.js (>= 10.13.0 < 10.16.3) • nodejs node.js (>= 12.0.0 < 12.8.1)

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References