CVEvulnerability

CVE-2019-9515

7.5 HIGH Published 2019-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-400, CWE-770

Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected configurations

• apple swiftnio (>= 1.0.0 <= 1.4.0) • apache traffic server (>= 6.0.0 <= 6.2.3) • apache traffic server (>= 7.0.0 <= 7.1.6) • apache traffic server (>= 8.0.0 <= 8.0.3) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • debian debian linux 9.0 • debian debian linux 10.0 • synology skynas • synology diskstation manager 6.2 • synology vs960hd firmware • fedoraproject fedora 29 • fedoraproject fedora 30 • opensuse leap 15.0 • opensuse leap 15.1 • redhat jboss core services 1.0 • redhat jboss enterprise application platform 7.2.0 • redhat jboss enterprise application platform 7.3.0 • redhat openshift container platform 4.1 • redhat openshift service mesh 1.0 • redhat openstack 14 • redhat quay 3.0.0 • redhat single sign-on 7.3 • redhat software collections 1.0 • redhat enterprise linux 8.0 • oracle graalvm 19.2.0 • mcafee web gateway (>= 7.7.2.0 < 7.7.2.24) • mcafee web gateway (>= 7.8.2.0 < 7.8.2.13) • mcafee web gateway (>= 8.1.0 < 8.2.0) • f5 big-ip local traffic manager (>= 11.6.1 < 11.6.5.1) • f5 big-ip local traffic manager (>= 12.1.0 < 12.1.5.1) • f5 big-ip local traffic manager (>= 13.1.0 < 13.1.3.2) • f5 big-ip local traffic manager (>= 14.0.0 < 14.0.1.1) • f5 big-ip local traffic manager (>= 14.1.0 < 14.1.2.1) • f5 big-ip local traffic manager (>= 15.0.0 < 15.0.1.1) • nodejs node.js (>= 8.0.0 <= 8.8.1) • nodejs node.js (>= 8.9.0 < 8.16.1) • nodejs node.js (>= 10.0.0 <= 10.12.0) • nodejs node.js (>= 10.13.0 < 10.16.3) • nodejs node.js (>= 12.0.0 < 12.8.1)

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References