CVE-2019-9518
CVE-2019-9518 · Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
CVSS 7.5 · High · EPSS 25.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
trafficserver Debian:12
- Affected ranges
- ECOSYSTEM: < 8.0.5+ds-1
Update to 8.0.5+ds-1
netty Ubuntu:Pro:18.04:LTS
- Versions
- 1:4.1.7-4
- 1:4.1.7-4ubuntu0.1~esm1
- 1:4.1.7-4ubuntu0.1
- Affected ranges
- ECOSYSTEM: < 1:4.1.7-4ubuntu0.1+esm1
Update to 1:4.1.7-4ubuntu0.1+esm1
trafficserver Ubuntu:18.04:LTS
- Versions
- 7.0.0-5
- 7.1.2+ds-2
- 7.1.2+ds-2build1
- 7.1.2+ds-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://kb.cert.org/vuls/id/605641/
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://seclists.org/bugtraq/2019/Aug/24
- http://seclists.org/fulldisclosure/2019/Aug/16
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K46011592
- https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E
- https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://www.debian.org/security/2019/dsa-4520
- https://seclists.org/bugtraq/2019/Sep/18
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://support.f5.com/csp/article/K46011592?utm_source=f5support&%3Butm_medium=RSS
- https://access.redhat.com/errata/RHSA-2019:3892
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2019-9518