01 Record

CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

HighPUBLISHEDCNA: certcc

CNA base score7.5 CVSS v3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 87.28% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 99.7% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-08-13 20:50Z7 YR AGO

Last updated

2024-08-04 21:54Z2 YR AGO

Reserved

2019-03-01

Assigning CNA

certcc

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400Uncontrolled Resource ConsumptionClass
CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.1

Document digest

d69930ef739141bd18bec3942f518b0f7d944fa590119efa9bde4ec6eac30a4c

05 Affected products

VendorProductVersionsPlatforms

apachetraffic_serverNot specified—

applemac_os_xNot specified—

appleswiftnioNot specified—

canonicalubuntu_linuxNot specified—

debiandebian_linuxNot specified—

f5big-ip_local_traffic_managerNot specified—

fedoraprojectfedoraNot specified—

mcafeeweb_gatewayNot specified—

nodejsnode.jsNot specified—

opensuseleapNot specified—

oraclegraalvmNot specified—

redhatamq_brokerNot specified—

redhatamq_streamsNot specified—

redhatansible_towerNot specified—

redhatceph_storageNot specified—

redhatcloudforms_managementengineNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_core_servicesNot specified—

redhatjboss_data_gridNot specified—

redhatjboss_data_virtualizationNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_application_platform_cdNot specified—

redhatjboss_enterprise_application_platform_eusNot specified—

redhatjboss_enterprise_bpms_platformNot specified—

redhatjboss_enterprise_brms_platformNot specified—

redhatjboss_fuseNot specified—

redhatjboss_single_sign_onNot specified—

redhatopenshiftNot specified—

redhatopenshift_application_runtimesNot specified—

redhatopenshift_container_platformNot specified—

redhatopenshift_service_meshNot specified—

redhatopenstackNot specified—

redhatquayNot specified—

redhatred_hat_single_sign_onNot specified—

redhatrhel_software_collectionsNot specified—

redhatservice_meshNot specified—

redhatsingle_sign-onNot specified—

redhatsoftware_collectionsNot specified—

synologydiskstation_managerNot specified—

synologyskynasNot specified—

synologyvs960hdNot specified—

synologyvs960hd_firmwareNot specified—

06 References

kb.cert.orgVU#605641https://kb.cert.org/vuls/id/605641/third-party-advisoryx_refsource_CERT-VN
github.comhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdx_refsource_MISC
lists.apache.org[trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attackshttps://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attackshttps://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attackshttps://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3Emailing-listx_refsource_MLIST
seclists.org20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0https://seclists.org/bugtraq/2019/Aug/24mailing-listx_refsource_BUGTRAQ
seclists.org20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0http://seclists.org/fulldisclosure/2019/Aug/16mailing-listx_refsource_FULLDISC
www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_33x_refsource_CONFIRM
support.f5.comhttps://support.f5.com/csp/article/K50233772x_refsource_CONFIRM
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0005/x_refsource_CONFIRM
lists.fedoraproject.orgFEDORA-2019-5a6a7bc12chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-6a2980de56https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/vendor-advisoryx_refsource_FEDORA
seclists.org20190825 [SECURITY] [DSA 4508-1] h2o security updatehttps://seclists.org/bugtraq/2019/Aug/43mailing-listx_refsource_BUGTRAQ
www.debian.orgDSA-4508https://www.debian.org/security/2019/dsa-4508vendor-advisoryx_refsource_DEBIAN
www.debian.orgDSA-4520https://www.debian.org/security/2019/dsa-4520vendor-advisoryx_refsource_DEBIAN
seclists.org20190910 [SECURITY] [DSA 4520-1] trafficserver security updatehttps://seclists.org/bugtraq/2019/Sep/18mailing-listx_refsource_BUGTRAQ
lists.opensuse.orgopenSUSE-SU-2019:2114http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2019:2115http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlvendor-advisoryx_refsource_SUSE
kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10296x_refsource_CONFIRM
access.redhat.comRHSA-2019:2766https://access.redhat.com/errata/RHSA-2019:2766vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2796https://access.redhat.com/errata/RHSA-2019:2796vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2861https://access.redhat.com/errata/RHSA-2019:2861vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2925vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2939vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2955vendor-advisoryx_refsource_REDHAT
support.f5.comhttps://support.f5.com/csp/article/K50233772?utm_source=f5support&amp%3Butm_medium=RSSx_refsource_CONFIRM
access.redhat.comRHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:3892vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4018vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4019vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4021https://access.redhat.com/errata/RHSA-2019:4021vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4020vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4045https://access.redhat.com/errata/RHSA-2019:4045vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4042https://access.redhat.com/errata/RHSA-2019:4042vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4040https://access.redhat.com/errata/RHSA-2019:4040vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4041https://access.redhat.com/errata/RHSA-2019:4041vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:4352https://access.redhat.com/errata/RHSA-2019:4352vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2020:0727https://access.redhat.com/errata/RHSA-2020:0727vendor-advisoryx_refsource_REDHAT
usn.ubuntu.comUSN-4308-1https://usn.ubuntu.com/4308-1/vendor-advisoryx_refsource_UBUNTU

07 Fixed in

AlmaLinux 8

nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f

CloudLinux 8

nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

h2o
Fixed in 2.2.5+dfsg2-3
trafficserver
Fixed in 8.0.5+ds-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.