CVE-2019-9512 : Some HTTP/2 implementations are vulnerable to ping floods, potentially leading t

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Published 2019-08-13 21:15:12

Updated 2022-08-12 18:41:20

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2019-9512

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Apache » Traffic Server
Versions from including (>=) 7.0.0 and up to, including, (<=) 7.1.6
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
Matching versions
Apache » Traffic Server
Versions from including (>=) 6.0.0 and up to, including, (<=) 6.2.3
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
Matching versions
Apache » Traffic Server
Versions from including (>=) 8.0.0 and up to, including, (<=) 8.0.3
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*
Matching versions
Apple » Swiftnio
Versions from including (>=) 1.0.0 and up to, including, (<=) 1.4.0
cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X
When used together with: Canonical » Ubuntu Linux
Nodejs » Node.js »
Versions from including (>=) 10.0.0 and up to, including, (<=) 10.12.0
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 10.13.0 and before (<) 10.16.3
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 8.0.0 and up to, including, (<=) 8.8.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions
Nodejs » Node.js » LTS Edition
Versions from including (>=) 8.9.0 and before (<) 8.16.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
Matching versions
Nodejs » Node.js »
Versions from including (>=) 12.0.0 and before (<) 12.8.1
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
Matching versions

Threat overview for CVE-2019-9512

Top countries where our scanners detected CVE-2019-9512

Top open port discovered on systems with this issue 80

IPs affected by CVE-2019-9512 1,027

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2019-9512!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-9512

EPSS FAQ

22.20%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-9512

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	AV:N/AC:L/Au:N/C:N/I:N/A:C	10.0	6.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
7.5	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	CERT/CC
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-9512

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Assigned by:
- cret@cert.org (Secondary)
- nvd@nist.gov (Primary)

References for CVE-2019-9512

https://security.netapp.com/advisory/ntap-20190823-0001/

August 2019 Kubernetes Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Aug/43

Bugtraq: [SECURITY] [DSA 4508-1] h2o security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2939

RHSA-2019:2939 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2726

RHSA-2019:2726 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://usn.ubuntu.com/4308-1/

USN-4308-1: Twisted vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4041

RHSA-2019:4041 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html

[security-announce] openSUSE-SU-2019:2130-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7@%3Cdev.trafficserver.apache.org%3E

[ANNOUNCE] Apache Traffic Server is vulnerable to various HTTP/2 attacks - Pony Mail
Third Party Advisory

CVEs referencing this url
https://www.synology.com/security/advisory/Synology_SA_19_33

Synology Inc.
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

[SECURITY] Fedora 29 Update: nodejs-10.16.3-1.fc29 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://support.f5.com/csp/article/K98053339

Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2966

RHSA-2019:2966 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2955

RHSA-2019:2955 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2766

RHSA-2019:2766 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4042

RHSA-2019:4042 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2594

RHSA-2019:2594 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2925

RHSA-2019:2925 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2682

RHSA-2019:2682 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html

[security-announce] openSUSE-SU-2019:2085-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2019/dsa-4520

Debian -- Security Information -- DSA-4520-1 trafficserver
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2019/dsa-4508

Debian -- Security Information -- DSA-4508-1 h2o
Third Party Advisory

CVEs referencing this url
http://seclists.org/fulldisclosure/2019/Aug/16

Full Disclosure: APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html

Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4273

RHSA-2019:4273 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html

[security-announce] openSUSE-SU-2019:2000-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4020

RHSA-2019:4020 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Sep/18

Bugtraq: [SECURITY] [DSA 4520-1] trafficserver security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04@%3Cusers.trafficserver.apache.org%3E

[ANNOUNCE] Apache Traffic Server is vulnerable to various HTTP/2 attacks - Pony Mail
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4040

RHSA-2019:4040 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4018

RHSA-2019:4018 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4269

RHSA-2019:4269 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19@%3Cannounce.trafficserver.apache.org%3E

[ANNOUNCE] Apache Traffic Server is vulnerable to various HTTP/2 attacks - Pony Mail
Third Party Advisory

CVEs referencing this url
https://kb.cert.org/vuls/id/605641/

VU#605641 - HTTP/2 implementations do not robustly handle abnormal traffic and resource exhaustion
Third Party Advisory;US Government Resource

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2661

RHSA-2019:2661 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2796

RHSA-2019:2796 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3245

RHSA-2019:3245 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2019/08/20/1

oss-security - [ANNOUNCE] Security release of Kubernetes v1.15.3, v1.14.6, v1.13.10 - CVE-2019-9512 and CVE-2019-9514
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2861

RHSA-2019:2861 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20190823-0004/

August 2019 Golang Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

[security-announce] openSUSE-SU-2019:2114-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2769

RHSA-2019:2769 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:2690

RHSA-2019:2690 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Aug/24

Bugtraq: APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0
Mailing List;Third Party Advisory

CVEs referencing this url
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

security-bulletins/2019-002.md at master · Netflix/security-bulletins · GitHub
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3906

RHSA-2019:3906 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html

[security-announce] openSUSE-SU-2019:2072-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3892

RHSA-2019:3892 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3265

RHSA-2019:3265 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://support.f5.com/csp/article/K98053339?utm_source=f5support&utm_medium=RSS

Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0406

RHSA-2020:0406 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4352

RHSA-2019:4352 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20190823-0005/

August 2019 Node.js Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html

[security-announce] openSUSE-SU-2019:2056-1: moderate: Security update f
Mailing List;Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

[SECURITY] Fedora 30 Update: nodejs-10.16.3-1.fc30 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4019

RHSA-2019:4019 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://kc.mcafee.com/corporate/index?page=content&id=SB10296

McAfee Security Bulletin - Updates and product status for HTTP/2 vulnerabilities (CVE-2019-9511, CVE-2019-9512, CVE-2019-9513, CVE-2019-9514, CVE-2019-9515, CVE-2019-9516, CVE-2019-9517, CVE-2019-9518
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/

[SECURITY] Fedora 30 Update: golang-1.12.9-1.fc30 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2019/dsa-4503

Debian -- Security Information -- DSA-4503-1 golang-1.11
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

[security-announce] openSUSE-SU-2019:2115-1: important: Security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2020:0727

RHSA-2020:0727 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://seclists.org/bugtraq/2019/Aug/31

Bugtraq: [SECURITY] [DSA 4503-1] golang-1.11 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:3131

RHSA-2019:3131 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4045

RHSA-2019:4045 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://access.redhat.com/errata/RHSA-2019:4021

RHSA-2019:4021 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/

[SECURITY] Fedora 29 Update: golang-1.11.13-1.fc29 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory

CVEs referencing this url