CVE-2019-9511
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service
- State
- Published
- Severity
- 7.5 High
- Published
- Aug 13, 2019
- Updated
- Aug 4, 2024
- Reserved
- Mar 1, 2019
Description
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.5 High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | certcc |
Weaknesses
- CWE-400 Uncontrolled Resource Consumption
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- VU#605641third-party-advisory
- USN-4099-1vendor-advisory
- FEDORA-2019-befd924cfevendor-advisory
- 20190822 [SECURITY] [DSA 4505-1] nginx security updatemailing-list
- FEDORA-2019-81985a8858vendor-advisory
- DSA-4505vendor-advisory
- FEDORA-2019-8a437d5c2fvendor-advisory
- FEDORA-2019-4427fd65bevendor-advisory
- FEDORA-2019-63ba15cc83vendor-advisory
- 20190902 [SECURITY] [DSA 4511-1] nghttp2 security updatemailing-list
- DSA-4511vendor-advisory
- FEDORA-2019-7a0b45fdc4vendor-advisory
- RHSA-2019:2692vendor-advisory
- openSUSE-SU-2019:2120vendor-advisory
- openSUSE-SU-2019:2114vendor-advisory
- openSUSE-SU-2019:2115vendor-advisory
- RHSA-2019:2745vendor-advisory
- RHSA-2019:2746vendor-advisory
- RHSA-2019:2775vendor-advisory
- RHSA-2019:2799vendor-advisory
- RHSA-2019:2925vendor-advisory
- RHSA-2019:2939vendor-advisory
- RHSA-2019:2949vendor-advisory
- openSUSE-SU-2019:2232vendor-advisory
- openSUSE-SU-2019:2234vendor-advisory
- RHSA-2019:2955vendor-advisory
- RHSA-2019:2966vendor-advisory
- openSUSE-SU-2019:2264vendor-advisory
- RHSA-2019:3041vendor-advisory
- RHSA-2019:3933vendor-advisory
- RHSA-2019:3935vendor-advisory
- RHSA-2019:3932vendor-advisory
- RHSA-2019:4018vendor-advisory
- RHSA-2019:4019vendor-advisory
- RHSA-2019:4021vendor-advisory
- RHSA-2019:4020vendor-advisory
- DSA-4669vendor-advisory
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://www.oracle.com/security-alerts/cpujan2021.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.