p PatchFirst

CVE-2019-9515

CVE-2019-9515 · Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 7.5 · High · EPSS 87.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • h2o Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.5+dfsg2-3

    Update to 2.2.5+dfsg2-3

  • trafficserver Debian:12

    Affected ranges
    • ECOSYSTEM: < 8.0.5+ds-1

    Update to 8.0.5+ds-1

  • golang-google-grpc Ubuntu:16.04:LTS

    Versions
    • 0.0~git20150514.0.f5ebd86-1
    • 0.0~git20150514.0.f5ebd86-2
    • 0.0~git20151002.0.3e7b7e5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:16.04:LTS

    Versions
    • 0.10.2-1
    • 0.11.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • trafficserver Ubuntu:16.04:LTS

    Versions
    • 5.3.0-2ubuntu1
    • 5.3.0-2ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twisted Ubuntu:18.04:LTS

    Versions
    • 16.6.0-2ubuntu3
    • 17.9.0-1
    • 17.9.0-2
    Affected ranges
    • ECOSYSTEM: < 17.9.0-2ubuntu0.1

    Update to 17.9.0-2ubuntu0.1

  • golang-google-grpc Ubuntu:18.04:LTS

    Versions
    • 1.0.4-1
    • 1.6.0-2
    • 1.6.0-3
    • 1.6.0-3ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:18.04:LTS

    Versions
    • 1.3.2-1
    • 1.3.2-1ubuntu1
    • 1.3.2-1.1~build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • h2o Ubuntu:Pro:18.04:LTS

    Versions
    • 2.2.3+dfsg-2
    • 2.2.4+dfsg-1
    • 2.2.4+dfsg-1build1
    • 2.2.4+dfsg-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • netty Ubuntu:Pro:18.04:LTS

    Versions
    • 1:4.1.7-4
    • 1:4.1.7-4ubuntu0.1~esm1
    • 1:4.1.7-4ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1:4.1.7-4ubuntu0.1+esm1

    Update to 1:4.1.7-4ubuntu0.1+esm1

  • trafficserver Ubuntu:18.04:LTS

    Versions
    • 7.0.0-5
    • 7.1.2+ds-2
    • 7.1.2+ds-2build1
    • 7.1.2+ds-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • twisted Ubuntu:20.04:LTS

    Versions
    • 18.9.0-3ubuntu1
    • 18.9.0-5
    • 18.9.0-6
    • 18.9.0-6build1
    Affected ranges
    • ECOSYSTEM: < 18.9.0-6ubuntu1

    Update to 18.9.0-6ubuntu1

  • golang-google-grpc Ubuntu:20.04:LTS

    Versions
    • 1.22.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:20.04:LTS

    Versions
    • 1.16.1-1
    • 1.16.1-1ubuntu1
    • 1.16.1-1ubuntu3
    • 1.16.1-1ubuntu4
    • 1.16.1-1ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:22.04:LTS

    Versions
    • 1.29.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:22.04:LTS

    Versions
    • 1.30.2-3
    • 1.30.2-3build1
    • 1.30.2-3build3
    • 1.30.2-3build5
    • 1.30.2-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:24.04:LTS

    Versions
    • 1.51.1-3build3
    • 1.51.1-3build4
    • 1.51.1-4
    • 1.51.1-4build1
    • 1.51.1-4build2
    • 1.51.1-4.1build3
    • 1.51.1-4.1build4
    • 1.51.1-4.1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:Pro:24.04:LTS

    Versions
    • 1.38.0+really1.33.3-1build1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.2
    • 1.38.0+really1.33.3-1ubuntu0.24.04.2+esm1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3+esm1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:25.10

    Versions
    • 1.64.0-6
    • 1.64.0-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:25.10

    Versions
    • 1.51.1-6
    • 1.51.1-6build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:26.10

    Versions
    • 1.66.3-2
    • 1.81.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.10

    Versions
    • 1.51.1-8ubuntu1
    • 1.51.1-9
    • 1.51.1-9ubuntu3
    • 1.51.1-10ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:26.04:LTS

    Versions
    • 1.64.0-7
    • 1.66.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →