CVEvulnerability

CVE-2019-9514

7.5 HIGH Published 2019-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-400, CWE-770

Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Affected configurations

• apple swiftnio (>= 1.0.0 <= 1.4.0) • apache traffic server (>= 6.0.0 <= 6.2.3) • apache traffic server (>= 7.0.0 <= 7.1.6) • apache traffic server (>= 8.0.0 <= 8.0.3) • debian debian linux 10.0 • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • debian debian linux 9.0 • synology skynas • synology diskstation manager 6.2 • synology vs960hd firmware • fedoraproject fedora 29 • fedoraproject fedora 30 • opensuse leap 15.0 • opensuse leap 15.1 • redhat developer tools 1.0 • redhat jboss core services 1.0 • redhat jboss enterprise application platform 7.2.0 • redhat jboss enterprise application platform 7.3.0 • redhat openshift container platform 3.9 • redhat openshift container platform 3.10 • redhat openshift container platform 3.11 • redhat openshift container platform 4.1 • redhat openshift container platform 4.2 • redhat openshift service mesh 1.0 • redhat openstack 14 • redhat quay 3.0.0 • redhat single sign-on 7.3 • redhat software collections 1.0 • redhat enterprise linux 8.0 • redhat enterprise linux eus 8.1 • redhat enterprise linux server 7.0 • redhat enterprise linux workstation 7.0 • oracle graalvm 19.2.0 • mcafee web gateway (>= 7.7.2.0 < 7.7.2.24) • mcafee web gateway (>= 7.8.2.0 < 7.8.2.13) • mcafee web gateway (>= 8.1.0 < 8.2.0) • netapp cloud insights • netapp trident • f5 big-ip local traffic manager (>= 11.6.1 < 11.6.5.1) • f5 big-ip local traffic manager (>= 12.1.0 < 12.1.5.1) • f5 big-ip local traffic manager (>= 13.1.0 < 13.1.3.2) • f5 big-ip local traffic manager (>= 14.0.0 < 14.0.1.1) • f5 big-ip local traffic manager (>= 14.1.0 < 14.1.2.1) • f5 big-ip local traffic manager (>= 15.0.0 < 15.0.1.1) • nodejs node.js (>= 8.0.0 <= 8.8.1) • nodejs node.js (>= 8.9.0 < 8.16.1) • nodejs node.js (>= 10.0.0 <= 10.12.0) • nodejs node.js (>= 10.13.0 < 10.16.3) • nodejs node.js (>= 12.0.0 < 12.8.1)

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References