01 Record

CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

HighPUBLISHEDCNA: certcc

CNA base score7.5 CVSS v3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

View raw JSON

02 Description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 27.89% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 97.9% of scored records. A rank, not a probability.
NVD base score: 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD analysis status: Modified. NVD last modified this record on 2026-06-17.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2019-08-13 20:50Z7 YR AGO

Last updated

2024-08-04 21:54Z2 YR AGO

Reserved

2019-03-01

Assigning CNA

certcc

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-400Uncontrolled Resource ConsumptionClass
CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.1

Document digest

48dbe74d206419f12a1790ecd2700946a9a0385f65e13570fd351face34f34ca

05 Affected products

VendorProductVersionsPlatforms

apachehttp_serverNot specified—

apachetraffic_serverNot specified—

applemac_os_xNot specified—

appleswiftnioNot specified—

canonicalubuntu_linuxNot specified—

debiandebian_linuxNot specified—

fedoraprojectfedoraNot specified—

mcafeeweb_gatewayNot specified—

netappclustered_data_ontapNot specified—

nodejsnode.jsNot specified—

opensuseleapNot specified—

oraclecommunications_element_managerNot specified—

oraclegraalvmNot specified—

oracleinstantis_enterprisetrackNot specified—

oracleretail_xstore_point_of_serviceNot specified—

redhatamq_brokerNot specified—

redhatansible_towerNot specified—

redhatcloudforms_managementengineNot specified—

redhatenterprise_linuxNot specified—

redhatjboss_core_servicesNot specified—

redhatjboss_data_gridNot specified—

redhatjboss_enterprise_application_platformNot specified—

redhatjboss_enterprise_bpms_platformNot specified—

redhatjboss_enterprise_web_serverNot specified—

redhatjboss_fuseNot specified—

redhatopenshiftNot specified—

redhatopenshift_application_runtimesNot specified—

redhatopenshift_service_meshNot specified—

redhatquayNot specified—

redhatred_hat_single_sign_onNot specified—

redhatrhel_software_collectionsNot specified—

redhatsoftware_collectionsNot specified—

synologydiskstation_managerNot specified—

synologyskynasNot specified—

synologyvs960hdNot specified—

synologyvs960hd_firmwareNot specified—

06 References

kb.cert.orgVU#605641https://kb.cert.org/vuls/id/605641/third-party-advisoryx_refsource_CERT-VN
github.comhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdx_refsource_MISC
lists.apache.org[httpd-announce] 20190814 CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workershttps://lists.apache.org/thread.html/4610762456644181b267c846423b3a990bd4aaea1886ecc7d51febdb%40%3Cannounce.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
www.openwall.com[oss-security] 20190814 CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workershttp://www.openwall.com/lists/oss-security/2019/08/15/7mailing-listx_refsource_MLIST
lists.apache.org[httpd-dev] 20190817 CVE-2019-10097 vs. CHANGEs entryhttps://lists.apache.org/thread.html/ec97fdfc1a859266e56fef084353a34e0a0b08901b3c1aa317a43c8c%40%3Cdev.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-dev] 20190817 Re: CVE-2019-10097 vs. CHANGEs entryhttps://lists.apache.org/thread.html/d89f999e26dfb1d50f247ead1fe8538014eb412b2dbe5be4b1a9ef50%40%3Cdev.httpd.apache.org%3Emailing-listx_refsource_MLIST
www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_33x_refsource_CONFIRM
support.f5.comhttps://support.f5.com/csp/article/K02591030x_refsource_CONFIRM
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0005/x_refsource_CONFIRM
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0003/x_refsource_CONFIRM
lists.fedoraproject.orgFEDORA-2019-5a6a7bc12chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-6a2980de56https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/vendor-advisoryx_refsource_FEDORA
www.debian.orgDSA-4509https://www.debian.org/security/2019/dsa-4509vendor-advisoryx_refsource_DEBIAN
seclists.org20190826 [SECURITY] [DSA 4509-1] apache2 security updatehttps://seclists.org/bugtraq/2019/Aug/47mailing-listx_refsource_BUGTRAQ
usn.ubuntu.comUSN-4113-1https://usn.ubuntu.com/4113-1/vendor-advisoryx_refsource_UBUNTU
lists.fedoraproject.orgFEDORA-2019-4427fd65behttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/vendor-advisoryx_refsource_FEDORA
lists.fedoraproject.orgFEDORA-2019-63ba15cc83https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/vendor-advisoryx_refsource_FEDORA
lists.opensuse.orgopenSUSE-SU-2019:2051http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.htmlvendor-advisoryx_refsource_SUSE
security.netapp.comhttps://security.netapp.com/advisory/ntap-20190905-0003/x_refsource_CONFIRM
security.gentoo.orgGLSA-201909-04https://security.gentoo.org/glsa/201909-04vendor-advisoryx_refsource_GENTOO
lists.opensuse.orgopenSUSE-SU-2019:2114http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlvendor-advisoryx_refsource_SUSE
lists.opensuse.orgopenSUSE-SU-2019:2115http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlvendor-advisoryx_refsource_SUSE
kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10296x_refsource_CONFIRM
access.redhat.comRHSA-2019:2893https://access.redhat.com/errata/RHSA-2019:2893vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2925vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2939vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2946https://access.redhat.com/errata/RHSA-2019:2946vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2950https://access.redhat.com/errata/RHSA-2019:2950vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2949https://access.redhat.com/errata/RHSA-2019:2949vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2955vendor-advisoryx_refsource_REDHAT
support.f5.comhttps://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSSx_refsource_CONFIRM
www.oracle.comhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlx_refsource_MISC
access.redhat.comRHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3933vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:3935https://access.redhat.com/errata/RHSA-2019:3935vendor-advisoryx_refsource_REDHAT
access.redhat.comRHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3932vendor-advisoryx_refsource_REDHAT
lists.apache.org[httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2020.htmlx_refsource_MISC
lists.apache.org[httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210330 svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210330 svn commit: r1888194 [12/13] - /httpd/site/trunk/content/security/json/https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST
lists.apache.org[httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.htmlhttps://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3Emailing-listx_refsource_MLIST

07 Fixed in

AlmaLinux 8

nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f

CloudLinux 8

nodejs-nodemon
Fixed

A version is affected if any line below covers it.
- Affected before 1.18.3-1.module_el8.3.0+2023+d2377ea3
- Affected before 1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
Fixed

A version is affected if any line below covers it.
- Affected before 17-3.module_el8.3.0+2023+d2377ea3
- Affected before 17-3.module_el8.4.0+2224+b07ac28e
- Affected before 17-3.module_el8.4.0+2521+c668cc9f

Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.

Debian 12

apache2
Fixed in 2.4.41-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

apache2
Fixed in 2.4.41-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

apache2
Fixed in 2.4.41-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 18.04 LTS

apache2
Fixed in 2.4.29-1ubuntu4.10

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.