CVEvulnerability

CVE-2019-9517

7.5 HIGH Published 2019-08-13 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-13
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
7.8 HIGH — AV:N/AC:L/Au:N/C:N/I:N/A:C
Weaknesses
CWE-400, CWE-770

Description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Affected configurations

• apple swiftnio (>= 1.0.0 <= 1.4.0) • apache http server (>= 2.4.20 < 2.4.40) • apache traffic server (>= 6.0.0 <= 6.2.3) • apache traffic server (>= 7.0.0 <= 7.1.6) • apache traffic server (>= 8.0.0 <= 8.0.3) • canonical ubuntu linux 16.04 • canonical ubuntu linux 18.04 • canonical ubuntu linux 19.04 • debian debian linux 9.0 • debian debian linux 10.0 • synology skynas • synology diskstation manager 6.2 • synology vs960hd firmware • fedoraproject fedora 29 • fedoraproject fedora 30 • opensuse leap 15.0 • opensuse leap 15.1 • redhat jboss core services 1.0 • redhat jboss enterprise application platform 7.2.0 • redhat jboss enterprise application platform 7.3.0 • redhat openshift service mesh 1.0 • redhat quay 3.0.0 • redhat software collections 1.0 • redhat enterprise linux 8.0 • oracle communications element manager 8.0.0 • oracle communications element manager 8.1.0 • oracle communications element manager 8.1.1 • oracle communications element manager 8.2.0 • oracle graalvm 19.2.0 • oracle instantis enterprisetrack (>= 17.1 <= 17.3) • oracle retail xstore point of service 7.1 • mcafee web gateway (>= 7.7.2.0 < 7.7.2.24) • mcafee web gateway (>= 7.8.2.0 < 7.8.2.13) • mcafee web gateway (>= 8.1.0 < 8.2.0) • netapp clustered data ontap • nodejs node.js (>= 8.0.0 <= 8.8.1) • nodejs node.js (>= 8.9.0 < 8.16.1) • nodejs node.js (>= 10.0.0 <= 10.12.0) • nodejs node.js (>= 10.13.0 < 10.16.3) • nodejs node.js (>= 12.0.0 < 12.8.1)

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References