Read the docs
TI-2019-06946 Aliases CVE-2019-9511GHSA-89fc-749h-w2fj

Some HTTP/2 implementations are vulnerable to window size manipulation and stream…

Priority HIGH 67CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 27 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Why it matters now

EPSS 0.59547 99th percentileScored 2026-11-07
Fix Partial Red Hat: 25 advisoriesRed Hat: 27 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*1.0.0 – 1.4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*10.12Running onApple
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*14.04Running onCanonical
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3VulnerableApache
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
  • cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.12 Running on ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* Versions 14.04 Running on ·Canonical
  • cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3 Vulnerable ·Apache
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*6.2VulnerableSynology
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*not specified by NVDRunning onSynology
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*19.2.0VulnerableOracle
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0VulnerableMcAfee
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*1.9.5 to before 1.16.1; 1.17.0 – 1.17.2VulnerableF5
cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*8.0.0 – 8.8.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*8.9.0 to before 8.16.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*10.0.0 – 10.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*10.13.0 to before 10.16.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*12.0.0 to before 12.8.1VulnerableNodeJS
  • cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Synology
  • cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:* Versions 19.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0 Vulnerable ·McAfee
  • cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* Versions 1.9.5 to before 1.16.1; 1.17.0 – 1.17.2 Vulnerable ·F5
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 8.0.0 – 8.8.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 8.9.0 to before 8.16.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 10.0.0 – 10.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 10.13.0 to before 10.16.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 to before 12.8.1 Vulnerable ·NodeJS

Remediation

Red Hat 25 advisories

  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2020:3192 Released 2020-07-28 · Red Hat rating Important
    Red Hat Fuse 7.7.0 release and security update
    • Red Hat Fuse 7.7.0
  • RHSA-2020:2565 Released 2020-06-15 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 18 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
Show 22 more Red Hat advisories
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:1445 Released 2020-04-14 · Red Hat rating Important
    Red Hat AMQ Broker 7.4.3 release and security update
    • Red Hat AMQ 7.4.3
  • RHSA-2020:0922 Released 2020-03-23 · Red Hat rating Important
    Red Hat AMQ Broker 7.6 release and security update
    • Red Hat AMQ
  • RHSA-2019:4019 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el7eap +47
  • RHSA-2019:4021 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:4020 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el8eap +47
  • RHSA-2019:4018 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el6eap +47
  • RHSA-2019:3932 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el6 +37
  • RHSA-2019:3933 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7 +37
  • RHSA-2019:3935 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
    • Red Hat JBoss Core Services
  • RHSA-2019:3041 Released 2019-10-14 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 1.0.1 RPMs
    • OpenShift Service Mesh 1.0 servicemesh-1.0.1-8.el8, servicemesh-citadel-1.0.1-8.el8, servicemesh-cni-1.0.1-8.el8 +12
    • Red Hat OpenShift Service Mesh 1.0 kiali-v1.0.6.redhat1-1.el7
  • RHSA-2019:2966 Released 2019-10-03 · Red Hat rating Important
    Red Hat Quay v3.1.1 security update
    • Quay v3 quay3/clair-jwt
  • RHSA-2019:2955 Released 2019-10-02 · Red Hat rating Important
    rh-nodejs8-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
  • RHSA-2019:2949 Released 2019-10-01 · Red Hat rating Important
    httpd24-httpd and httpd24-nghttp2 security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.34-8.el6.1, httpd24-httpd-devel-2.4.34-8.el6.1, httpd24-httpd-manual-2.4.34-8.el6.1 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.34-8.el6.1, httpd24-httpd-devel-2.4.34-8.el6.1, httpd24-httpd-manual-2.4.34-8.el6.1 +8
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
  • RHSA-2019:2946 Released 2019-10-01 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el6 +8
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el7 +8
  • RHSA-2019:2939 Released 2019-10-01 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
  • RHSA-2019:2925 Released 2019-09-30 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x::nodejs:10 +15
  • RHSA-2019:2799 Released 2019-09-19 · Red Hat rating Important
    nginx:1.14 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nginx-1:1.14.1-9.module+el8.0.0+4108+af250afe.aarch64::nginx:1.14, nginx-1:1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le::nginx:1.14, nginx-1:1.14.1-9.module+el8.0.0+4108+af250afe.s390x::nginx:1.14 +24
  • RHSA-2019:2775 Released 2019-09-17 · Red Hat rating Important
    rh-nginx114-nginx security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
  • RHSA-2019:2746 Released 2019-09-13 · Red Hat rating Important
    rh-nginx112-nginx security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
  • RHSA-2019:2745 Released 2019-09-13 · Red Hat rating Important
    rh-nginx110-nginx security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-nginx110-nginx-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el6.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-nginx110-nginx-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el6.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
  • RHSA-2019:2692 Released 2019-09-09 · Red Hat rating Important
    nghttp2 security update
    • Red Hat CodeReady Linux Builder (v. 8) libnghttp2-devel-1.33.0-1.el8_0.1, nghttp2-1.33.0-1.el8_0.1
    • Red Hat Enterprise Linux BaseOS (v. 8) libnghttp2-1.33.0-1.el8_0.1, nghttp2-1.33.0-1.el8_0.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat JBoss Enterprise Web Server 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
OpenShift Service Mesh 1.0Fixed RHSA-2019:3041
Quay v3Fixed RHSA-2019:2966
Red Hat AMQFixed RHSA-2020:0922
Red Hat AMQ 7.4.3Fixed RHSA-2020:1445
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2019:2692
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:2799, RHSA-2019:2925
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2019:2692
Red Hat Fuse 7.7.0Fixed RHSA-2020:3192
Red Hat JBoss Core ServicesFixed RHSA-2019:3935
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2019:2946, RHSA-2019:3932
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2019:2946, RHSA-2019:3933
Red Hat JBoss EAP 7.2Fixed RHSA-2019:4021
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:4018
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:4019
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:4020
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2565
Red Hat OpenShift Service Mesh 1.0Fixed RHSA-2019:3041
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:2745, RHSA-2019:2949
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:2745, RHSA-2019:2949
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 15 products
  • CloudForms Management Engine 5
  • Red Hat Ansible Tower 3
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Web Server 5
  • Red Hat OpenShift Container Platform 3.10
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 3.9
  • Red Hat OpenShift Container Platform 4
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9511
  2. 2026-10-03 Alias added: GHSA-89fc-749h-w2fj

References

Patch 1

Advisory 45

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences