CVE-2019-9518

Exploitation

Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.

SSVC decision

Not assessed by CISA

EPSS probability

25.44% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 97.7% of scored records. A rank, not a probability.

NVD base score

7.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2019-08-13 20:50Z7 YR AGO

Last updated

2024-08-04 21:54Z2 YR AGO

Reserved

2019-03-01

Assigning CNA

certcc

Record state

PUBLISHED

Severity

High (CVSS 7.5)

CNA CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

• CWE-400Uncontrolled Resource ConsumptionClass
• CWE-770Allocation of Resources Without Limits or ThrottlingBase

Data version

5.1

Document digest

98c41a23e4b9ae3e3337178d29037025187dce6a0dcbc9fd71ad7052ef90de19

• kb.cert.orgVU#605641https://kb.cert.org/vuls/id/605641/third-party-advisoryx_refsource_CERT-VN
• github.comhttps://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdx_refsource_MISC
• seclists.org20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0https://seclists.org/bugtraq/2019/Aug/24mailing-listx_refsource_BUGTRAQ
• seclists.org20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0http://seclists.org/fulldisclosure/2019/Aug/16mailing-listx_refsource_FULLDISC
• www.synology.comhttps://www.synology.com/security/advisory/Synology_SA_19_33x_refsource_CONFIRM
• support.f5.comhttps://support.f5.com/csp/article/K46011592x_refsource_CONFIRM
• lists.apache.org[trafficserver-announce] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frameshttps://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[trafficserver-users] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frameshttps://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[trafficserver-dev] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frameshttps://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3Emailing-listx_refsource_MLIST
• security.netapp.comhttps://security.netapp.com/advisory/ntap-20190823-0005/x_refsource_CONFIRM
• lists.fedoraproject.orgFEDORA-2019-5a6a7bc12chttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/vendor-advisoryx_refsource_FEDORA
• lists.fedoraproject.orgFEDORA-2019-6a2980de56https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/vendor-advisoryx_refsource_FEDORA
• www.debian.orgDSA-4520https://www.debian.org/security/2019/dsa-4520vendor-advisoryx_refsource_DEBIAN
• seclists.org20190910 [SECURITY] [DSA 4520-1] trafficserver security updatehttps://seclists.org/bugtraq/2019/Sep/18mailing-listx_refsource_BUGTRAQ
• lists.opensuse.orgopenSUSE-SU-2019:2114http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlvendor-advisoryx_refsource_SUSE
• lists.opensuse.orgopenSUSE-SU-2019:2115http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlvendor-advisoryx_refsource_SUSE
• kc.mcafee.comhttps://kc.mcafee.com/corporate/index?page=content&id=SB10296x_refsource_CONFIRM
• access.redhat.comRHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2925vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2939vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2955vendor-advisoryx_refsource_REDHAT
• support.f5.comhttps://support.f5.com/csp/article/K46011592?utm_source=f5support&amp%3Butm_medium=RSSx_refsource_CONFIRM
• access.redhat.comRHSA-2019:3892https://access.redhat.com/errata/RHSA-2019:3892vendor-advisoryx_refsource_REDHAT
• lists.apache.org[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilitieshttps://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Emailing-listx_refsource_MLIST
• access.redhat.comRHSA-2019:4352https://access.redhat.com/errata/RHSA-2019:4352vendor-advisoryx_refsource_REDHAT
• access.redhat.comRHSA-2020:0727https://access.redhat.com/errata/RHSA-2020:0727vendor-advisoryx_refsource_REDHAT
• lists.apache.org[cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16698) Security vulnerability CVE-2019-9518 for Nettyhttps://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST
• lists.apache.org[cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16698) Security vulnerability CVE-2019-9518 for Nettyhttps://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3Emailing-listx_refsource_MLIST