CVE-2019-9514
CVE-2019-9514 · Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
CVSS 7.5 · High · EPSS 82.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
h2o Debian:12
- Affected ranges
- ECOSYSTEM: < 2.2.5+dfsg2-3
Update to 2.2.5+dfsg2-3
nodejs Debian:12
- Affected ranges
- ECOSYSTEM: < 10.16.3~dfsg-1
Update to 10.16.3~dfsg-1
nodejs Debian:13
- Affected ranges
- ECOSYSTEM: < 10.16.3~dfsg-1
Update to 10.16.3~dfsg-1
nodejs Debian:14
- Affected ranges
- ECOSYSTEM: < 10.16.3~dfsg-1
Update to 10.16.3~dfsg-1
rust-h2 Debian:12
- Versions
- 0.3.13-2
- 0.3.21-1
- 0.3.24-1
- 0.4.13-1
- 0.4.19-1
- 0.4.4-1
- 0.4.4-2
- 0.4.6-1~exp1
- 0.4.7-1
- 0.4.7-2
- 0.4.7-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
rust-h2 Debian:13
- Affected ranges
- ECOSYSTEM: < 0.3.24-1
Update to 0.3.24-1
rust-h2 Debian:14
- Affected ranges
- ECOSYSTEM: < 0.3.24-1
Update to 0.3.24-1
trafficserver Debian:12
- Affected ranges
- ECOSYSTEM: < 8.0.5+ds-1
Update to 8.0.5+ds-1
golang-1.10 Ubuntu:14.04:LTS
- Versions
- 1.10.4-2ubuntu1~14.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nodejs Ubuntu:Pro:14.04:LTS
- Versions
- 0.10.15~dfsg1-4
- 0.10.21~dfsg1-1
- 0.10.22~dfsg1-2
- 0.10.23~dfsg1-1
- 0.10.23~dfsg1-2
- 0.10.23~dfsg1-3
- 0.10.24~dfsg1-1
- 0.10.25~dfsg2-2
- 0.10.25~dfsg2-2ubuntu1
- 0.10.25~dfsg2-2ubuntu1.2
- 0.10.25~dfsg2-2ubuntu1.2+esm1
- 0.10.25~dfsg2-2ubuntu1.2+esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.10 Ubuntu:16.04:LTS
- Versions
- 1.10.4-2ubuntu1~16.04.1
- 1.10.4-2ubuntu1~16.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.6 Ubuntu:16.04:LTS
- Versions
- 1.6-0ubuntu1
- 1.6-0ubuntu2
- 1.6-0ubuntu3
- 1.6-0ubuntu4
- 1.6-0ubuntu5
- 1.6.1-0ubuntu1
- 1.6.2-0ubuntu5~16.04
- 1.6.2-0ubuntu5~16.04.2
- 1.6.2-0ubuntu5~16.04.3
- 1.6.2-0ubuntu5~16.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-google-grpc Ubuntu:16.04:LTS
- Versions
- 0.0~git20150514.0.f5ebd86-1
- 0.0~git20150514.0.f5ebd86-2
- 0.0~git20151002.0.3e7b7e5-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
grpc Ubuntu:16.04:LTS
- Versions
- 0.10.2-1
- 0.11.1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
nodejs Ubuntu:Pro:16.04:LTS
- Versions
- 0.10.25~dfsg2-2ubuntu1
- 4.2.2~dfsg-1
- 4.2.3~dfsg-1
- 4.2.4~dfsg-1ubuntu1
- 4.2.4~dfsg-2
- 4.2.6~dfsg-1ubuntu1
- 4.2.6~dfsg-1ubuntu4
- 4.2.6~dfsg-1ubuntu4.1
- 4.2.6~dfsg-1ubuntu4.2
- 4.2.6~dfsg-1ubuntu4.2+esm1
- 4.2.6~dfsg-1ubuntu4.2+esm2
- 4.2.6~dfsg-1ubuntu4.2+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trafficserver Ubuntu:16.04:LTS
- Versions
- 5.3.0-2ubuntu1
- 5.3.0-2ubuntu2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
twisted Ubuntu:18.04:LTS
- Versions
- 16.6.0-2ubuntu3
- 17.9.0-1
- 17.9.0-2
- Affected ranges
- ECOSYSTEM: < 17.9.0-2ubuntu0.1
Update to 17.9.0-2ubuntu0.1
golang-1.10 Ubuntu:18.04:LTS
- Versions
- 1.10~rc1-1
- 1.10~rc1-1ubuntu1
- 1.10~rc1-2ubuntu1
- 1.10~rc2-1ubuntu1
- 1.10-1ubuntu1
- 1.10.1-1ubuntu2
- 1.10.4-2ubuntu1~18.04.1
- 1.10.4-2ubuntu1~18.04.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.8 Ubuntu:18.04:LTS
- Versions
- 1.8.3-2ubuntu1
- 1.8.3-2ubuntu1.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-1.9 Ubuntu:18.04:LTS
- Versions
- 1.9.1-2ubuntu1
- 1.9.2-1ubuntu1
- 1.9.2-3ubuntu1
- 1.9.3-1ubuntu1
- 1.9.4-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
golang-google-grpc Ubuntu:18.04:LTS
- Versions
- 1.0.4-1
- 1.6.0-2
- 1.6.0-3
- 1.6.0-3ubuntu0.18.04.1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
grpc Ubuntu:18.04:LTS
- Versions
- 1.3.2-1
- 1.3.2-1ubuntu1
- 1.3.2-1.1~build1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
h2o Ubuntu:Pro:18.04:LTS
- Versions
- 2.2.3+dfsg-2
- 2.2.4+dfsg-1
- 2.2.4+dfsg-1build1
- 2.2.4+dfsg-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
- https://seclists.org/bugtraq/2019/Aug/24
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://seclists.org/bugtraq/2019/Aug/31
- https://www.debian.org/security/2019/dsa-4503
- https://support.f5.com/csp/article/K01988340
- http://www.openwall.com/lists/oss-security/2019/08/20/1
- https://security.netapp.com/advisory/ntap-20190823-0001/
- https://security.netapp.com/advisory/ntap-20190823-0004/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://seclists.org/bugtraq/2019/Aug/43
- https://www.debian.org/security/2019/dsa-4508
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
- https://nvd.nist.gov/vuln/detail/CVE-2019-9514