01 Record

CVE-2019-9516

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

HighPUBLISHEDCNA: certcc

CNA base score7.5 CVSS v3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 56.26% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 98.9% of scored records. A rank, not a probability.
NVD base score: 6.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-08-13 20:50Z7 YR AGO

Last updated

2024-08-04 21:54Z2 YR AGO

Reserved

2019-03-01

Assigning CNA

certcc

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400Uncontrolled Resource ConsumptionClass
CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.1

Document digest

6010cf729254657975bca76d284204212b6dca6ae1246bd885bfd60d33e8c2fe

05 Affected products

VendorProductVersionsPlatforms

apachetraffic_serverNot specified—

applemac_os_xNot specified—

appleswiftnioNot specified—

canonicalubuntu_linuxNot specified—

debiandebian_linuxNot specified—

f5nginxNot specified—

fedoraprojectfedoraNot specified—

mcafeeweb_gatewayNot specified—

nodejsnode.jsNot specified—

opensuseleapNot specified—

oraclegraalvmNot specified—

redhatamq_brokerNot specified—

redhatansible_towerNot specified—

redhatcloudforms_managementengineNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_core_servicesNot specified—

redhatjboss_data_gridNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_bpms_platformNot specified—

redhatjboss_enterprise_web_serverNot specified—

redhatjboss_fuseNot specified—

redhatopenshiftNot specified—

redhatopenshift_application_runtimesNot specified—

redhatopenshift_service_meshNot specified—

redhatquayNot specified—

redhatred_hat_3scale_ampNot specified—

redhatred_hat_single_sign_onNot specified—

redhatrhel_software_collectionsNot specified—

redhatsoftware_collectionsNot specified—

synologydiskstation_managerNot specified—

synologyskynasNot specified—

synologyvs960hdNot specified—

synologyvs960hd_firmwareNot specified—

06 References

kb.cert.orgVU#605641https://kb.cert.org/vuls/id/605641/third-party-advisoryx_refsource_CERT-VN
github.comhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdx_refsource_MISC
seclists.org20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0https://seclists.org/bugtraq/2019/Aug/24mailing-listx_refsource_BUGTRAQ
usn.ubuntu.comUSN-4099-1https://usn.ubuntu.com/4099-1/vendor-advisoryx_refsource_UBUNTU
seclists.org20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0http://seclists.org/fulldisclosure/2019/Aug/16mailing-listx_refsource_FULLDISC
www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_33x_refsource_CONFIRM
support.f5.comhttps://support.f5.com/csp/article/K02591030x_refsource_CONFIRM
lists.fedoraproject.orgFEDORA-2019-befd924cfehttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/vendor-advisoryx_refsource_FEDORA
seclists.org20190822 [SECURITY] [DSA 4505-1] nginx security updatehttps://seclists.org/bugtraq/2019/Aug/40mailing-listx_refsource_BUGTRAQ
www.debian.orgDSA-4505https://www.debian.org/security/2019/dsa-4505vendor-advisoryx_refsource_DEBIAN
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0002/x_refsource_CONFIRM
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0005/x_refsource_CONFIRM
lists.fedoraproject.orgFEDORA-2019-5a6a7bc12chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-6a2980de56https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-4427fd65behttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-63ba15cc83https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-7a0b45fdc4https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/vendor-advisoryx_refsource_FEDORA
lists.opensuse.orgopenSUSE-SU-2019:2120http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2019:2114http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2019:2115http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlvendor-advisoryx_refsource_SUSE
kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10296x_refsource_CONFIRM
access.redhat.comRHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2745vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2746vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2775vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2799vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2925vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2939vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2946https://access.redhat.com/errata/RHSA-2019:2946vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2950https://access.redhat.com/errata/RHSA-2019:2950vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2955vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:2966vendor-advisoryx_refsource_REDHAT
lists.opensuse.orgopenSUSE-SU-2019:2264http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlvendor-advisoryx_refsource_SUSE
support.f5.comhttps://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSSx_refsource_CONFIRM
access.redhat.comRHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3933vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:3935https://access.redhat.com/errata/RHSA-2019:3935vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3932vendor-advisoryx_refsource_REDHAT
lists.fedoraproject.orgFEDORA-2021-d5b2c18fe6https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/vendor-advisoryx_refsource_FEDORA

07 Fixed in

AlmaLinux 8

nginx
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-all-modules
Fixed in 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
nginx-filesystem
Fixed in 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
nginx-mod-http-image-filter
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-http-perl
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-http-xslt-filter
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-mail
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-stream
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f

Arch Linux

nginx
Fixed in 1.16.1-1
nginx-mainline
Fixed in 1.17.3-1

Source: Arch Linux Security Tracker, the Arch Linux security team. Reformatted by exploit.cc.

CloudLinux 8

nginx
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-all-modules
Fixed in 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
nginx-filesystem
Fixed in 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
nginx-mod-http-image-filter
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-http-perl
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-http-xslt-filter
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-mail
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nginx-mod-stream
Fixed

A version is affected if any line below covers it.
- Affected before 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma
- Affected before 1:1.14.1-9.module_el8.5.0+34+dc1cfba5.alma
nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

nginx
Fixed in 1.14.2-3

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

nginx
Fixed in 1.14.2-3

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

nginx
Fixed in 1.14.2-3

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 16.04 LTS

nginx
Fixed in 1.10.3-0ubuntu0.16.04.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

nginx
Fixed in 1.14.0-0ubuntu1.4

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.