CVE-2019-9514
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
02 Description
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 82.81% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 99.6% of scored records. A rank, not a probability.
- NVD base score
- 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Important. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2019-08-13 00:00Z7 YR AGO
- Last updated
- 2024-08-04 21:54Z2 YR AGO
- Reserved
- 2019-03-01
- Assigning CNA
- certcc
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.5)
- CNA CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- Data version
- 5.1
- Document digest
- 839e0da6e3a0140f9b19902064f88c33eeb83260abdaf6ddee89c7d8ccd8ac4c
05 Affected products
06 References
- kb.cert.orgVU#605641https://kb.cert.org/vuls/id/605641/
- github.comhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- lists.apache.org[trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attackshttps://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
- lists.apache.org[trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attackshttps://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
- lists.apache.org[trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attackshttps://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
- seclists.org20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0https://seclists.org/bugtraq/2019/Aug/24
- seclists.org20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0http://seclists.org/fulldisclosure/2019/Aug/16
- www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_33
- seclists.org20190819 [SECURITY] [DSA 4503-1] golang-1.11 security updatehttps://seclists.org/bugtraq/2019/Aug/31
- www.debian.orgDSA-4503https://www.debian.org/security/2019/dsa-4503
- support.f5.comhttps://support.f5.com/csp/article/K01988340
- www.openwall.com[oss-security] 20190819 [ANNOUNCE] Security release of Kubernetes v1.15.3, v1.14.6, v1.13.10 - CVE-2019-9512 and CVE-2019-9514http://www.openwall.com/lists/oss-security/2019/08/20/1
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0001/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0004/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0005/
- lists.opensuse.orgopenSUSE-SU-2019:2000http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
- lists.fedoraproject.orgFEDORA-2019-5a6a7bc12chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- lists.fedoraproject.orgFEDORA-2019-6a2980de56https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- seclists.org20190825 [SECURITY] [DSA 4508-1] h2o security updatehttps://seclists.org/bugtraq/2019/Aug/43
- www.debian.orgDSA-4508https://www.debian.org/security/2019/dsa-4508
- lists.opensuse.orgopenSUSE-SU-2019:2056http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
- lists.opensuse.orgopenSUSE-SU-2019:2072http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
- lists.fedoraproject.orgFEDORA-2019-55d101a740https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- lists.fedoraproject.orgFEDORA-2019-65db7ad6c7https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
- lists.opensuse.orgopenSUSE-SU-2019:2085http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
- access.redhat.comRHSA-2019:2682https://access.redhat.com/errata/RHSA-2019:2682
- www.debian.orgDSA-4520https://www.debian.org/security/2019/dsa-4520
- access.redhat.comRHSA-2019:2726https://access.redhat.com/errata/RHSA-2019:2726
- seclists.org20190910 [SECURITY] [DSA 4520-1] trafficserver security updatehttps://seclists.org/bugtraq/2019/Sep/18
- access.redhat.comRHSA-2019:2594https://access.redhat.com/errata/RHSA-2019:2594
- lists.opensuse.orgopenSUSE-SU-2019:2114http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- lists.opensuse.orgopenSUSE-SU-2019:2115http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- access.redhat.comRHSA-2019:2661https://access.redhat.com/errata/RHSA-2019:2661
- kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10296
- access.redhat.comRHSA-2019:2690https://access.redhat.com/errata/RHSA-2019:2690
- access.redhat.comRHSA-2019:2766https://access.redhat.com/errata/RHSA-2019:2766
- lists.opensuse.orgopenSUSE-SU-2019:2130http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
- access.redhat.comRHSA-2019:2796https://access.redhat.com/errata/RHSA-2019:2796
- access.redhat.comRHSA-2019:2861https://access.redhat.com/errata/RHSA-2019:2861
- access.redhat.comRHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2925
- access.redhat.comRHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2939
- access.redhat.comRHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2955
- access.redhat.comRHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:2966
- support.f5.comhttps://support.f5.com/csp/article/K01988340?utm_source=f5support&%3Butm_medium=RSS
- access.redhat.comRHSA-2019:3131https://access.redhat.com/errata/RHSA-2019:3131
- access.redhat.comRHSA-2019:2769https://access.redhat.com/errata/RHSA-2019:2769
- access.redhat.comRHSA-2019:3245https://access.redhat.com/errata/RHSA-2019:3245
- access.redhat.comRHSA-2019:3265https://access.redhat.com/errata/RHSA-2019:3265
- access.redhat.comRHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:3892
- access.redhat.comRHSA-2019:3906https://access.redhat.com/errata/RHSA-2019:3906
- access.redhat.comRHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4018
- access.redhat.comRHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4019
- access.redhat.comRHSA-2019:4021https://access.redhat.com/errata/RHSA-2019:4021
- access.redhat.comRHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4020
- access.redhat.comRHSA-2019:4045https://access.redhat.com/errata/RHSA-2019:4045
- access.redhat.comRHSA-2019:4042https://access.redhat.com/errata/RHSA-2019:4042
- access.redhat.comRHSA-2019:4040https://access.redhat.com/errata/RHSA-2019:4040
- access.redhat.comRHSA-2019:4041https://access.redhat.com/errata/RHSA-2019:4041
- access.redhat.comRHSA-2019:4269https://access.redhat.com/errata/RHSA-2019:4269
- access.redhat.comRHSA-2019:4273https://access.redhat.com/errata/RHSA-2019:4273
- access.redhat.comRHSA-2019:4352https://access.redhat.com/errata/RHSA-2019:4352
- access.redhat.comRHSA-2020:0406https://access.redhat.com/errata/RHSA-2020:0406
- access.redhat.comRHSA-2020:0727https://access.redhat.com/errata/RHSA-2020:0727
- usn.ubuntu.comUSN-4308-1https://usn.ubuntu.com/4308-1/
- www.debian.orgDSA-4669https://www.debian.org/security/2020/dsa-4669
- lists.debian.org[debian-lts-announce] 20201208 [SECURITY] [DLA 2485-1] golang-golang-x-net-dev security updatehttps://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
- www.openwall.com[oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementationshttp://www.openwall.com/lists/oss-security/2023/10/18/8
07 Fixed in
AlmaLinux 8
- containernetworking-plugins Fixed
A version is affected if any line below covers it.
- Affected before 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43
- Affected before 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43
- Affected before 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082
- containers-common Fixed
A version is affected if any line below covers it.
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
- fuse-overlayfs Fixed
A version is affected if any line below covers it.
- Affected before 0.3-5.module_el8.3.0+2044+12421f43
- Affected before 0.3-5.module_el8.4.0+2496+12421f43
- Affected before 0.3-5.module_el8.5.0+119+9a9ec082
- nodejs-nodemon Fixed
A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
- nodejs-packaging Fixed
A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f
- oci-systemd-hook Fixed
A version is affected if any line below covers it.
- Affected before 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
- Affected before 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
- Affected before 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
- oci-umount Fixed
A version is affected if any line below covers it.
- Affected before 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
- Affected before 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
- Affected before 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
- runc Fixed
A version is affected if any line below covers it.
- Affected before 1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43
- Affected before 1.0.0-56.rc5.dev.git2abd837.module_el8.4.0+2496+12421f43
- Affected before 1.0.0-56.rc5.dev.git2abd837.module_el8.5.0+119+9a9ec082
- skopeo Fixed
A version is affected if any line below covers it.
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Arch Linux
- go Fixed in 2:1.12.8-1
Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.
CloudLinux 8
- containernetworking-plugins Fixed
A version is affected if any line below covers it.
- Affected before 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43
- Affected before 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43
- Affected before 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082
- containers-common Fixed
A version is affected if any line below covers it.
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
- fuse-overlayfs Fixed
A version is affected if any line below covers it.
- Affected before 0.3-5.module_el8.3.0+2044+12421f43
- Affected before 0.3-5.module_el8.4.0+2496+12421f43
- Affected before 0.3-5.module_el8.5.0+119+9a9ec082
- nodejs-nodemon Fixed
A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
- nodejs-packaging Fixed
A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f
- oci-systemd-hook Fixed
A version is affected if any line below covers it.
- Affected before 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
- Affected before 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
- Affected before 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
- oci-umount Fixed
A version is affected if any line below covers it.
- Affected before 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
- Affected before 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
- Affected before 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
- runc Fixed
A version is affected if any line below covers it.
- Affected before 1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43
- Affected before 1.0.0-56.rc5.dev.git2abd837.module_el8.4.0+2496+12421f43
- Affected before 1.0.0-56.rc5.dev.git2abd837.module_el8.5.0+119+9a9ec082
- skopeo Fixed
A version is affected if any line below covers it.
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
- Affected before 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- h2o Fixed in 2.2.5+dfsg2-3
- nodejs Fixed in 10.16.3~dfsg-1
- rust-h2 No fix yet
- trafficserver Fixed in 8.0.5+ds-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- nodejs Fixed in 10.16.3~dfsg-1
- rust-h2 Fixed in 0.3.24-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- nodejs Fixed in 10.16.3~dfsg-1
- rust-h2 Fixed in 0.3.24-1
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 14.04 LTS
- golang-1.10 No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 16.04 LTS
- golang-1.10 No fix yet
- golang-1.6 No fix yet
- golang-google-grpc No fix yet
- grpc No fix yet
- trafficserver No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- golang-1.10 No fix yet
- golang-1.8 No fix yet
- golang-1.9 No fix yet
- golang-google-grpc No fix yet
- grpc No fix yet
- trafficserver No fix yet
- twisted Fixed in 17.9.0-2ubuntu0.1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 20.04 LTS
- golang-google-grpc No fix yet
- grpc No fix yet
- twisted Fixed in 18.9.0-6ubuntu1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 22.04 LTS
- golang-google-grpc No fix yet
- grpc No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 24.04 LTS
- grpc No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 25.10
- golang-google-grpc No fix yet
- grpc No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.04 LTS
- golang-google-grpc No fix yet
- grpc No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 26.10
- golang-google-grpc No fix yet
- grpc No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 14.04 LTS
- nodejs No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 16.04 LTS
- nodejs No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 18.04 LTS
- h2o No fix yet
- netty Fixed in 1:4.1.7-4ubuntu0.1+esm1Available with Ubuntu Pro: https://ubuntu.com/pro
- nodejs No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu Pro 24.04 LTS
- golang-google-grpc No fix yet
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.