Read the docs
TI-2019-06950 Aliases CVE-2019-9515GHSA-9259-5376-vjcj

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a…

Priority HIGH 75CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 27 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Why it matters now

EPSS 0.87286 99th percentileScored 2026-11-07
Fix Partial Red Hat: 25 advisoriesRed Hat: 27 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*1.0.0 – 1.4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*10.12Running onApple
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*14.04Running onCanonical
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3VulnerableApache
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
  • cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.12 Running on ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* Versions 14.04 Running on ·Canonical
  • cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3 Vulnerable ·Apache
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*6.2VulnerableSynology
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*not specified by NVDRunning onSynology
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*14VulnerableRed Hat
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:*7.3VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*19.2.0VulnerableOracle
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0VulnerableMcAfee
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*11.6.1 to before 11.6.5.1; 12.1.0 to before 12.1.5.1; 13.1.0 to before 13.1.3.2; 14.0.0 to before 14.0.1.1; 14.1.0 to before 14.1.2.1; 15.0.0 to before 15.0.1.1VulnerableF5
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*8.0.0 – 8.8.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*8.9.0 to before 8.16.1VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*10.0.0 – 10.12.0VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*10.13.0 to before 10.16.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*12.0.0 to before 12.8.1VulnerableNodeJS
  • cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Synology
  • cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:7.3:*:*:*:*:*:*:* Versions 7.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:* Versions 19.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0 Vulnerable ·McAfee
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 11.6.1 to before 11.6.5.1; 12.1.0 to before 12.1.5.1; 13.1.0 to before 13.1.3.2; 14.0.0 to before 14.0.1.1; 14.1.0 to before 14.1.2.1; 15.0.0 to before 15.0.1.1 Vulnerable ·F5
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 8.0.0 – 8.8.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 8.9.0 to before 8.16.1 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 10.0.0 – 10.12.0 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 10.13.0 to before 10.16.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 to before 12.8.1 Vulnerable ·NodeJS

Remediation

Red Hat 25 advisories

  • RHSA-2024:5856 Released 2024-08-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.ep7.el7, eap7-infinispan-8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-infinispan-cachestore-jdbc-8.2.11-1.SP2_redhat_00001.1.ep7.el7 +12
  • RHSA-2020:3197 Released 2020-07-29 · Red Hat rating Important
    Red Hat Process Automation Manager 7.8.0 Security Update
    • Red Hat Process Automation 7
  • RHSA-2020:3196 Released 2020-07-29 · Red Hat rating Important
    Red Hat Decision Manager 7.8.0 Security Update
    • Red Hat Decision Manager 7
Show 22 more Red Hat advisories
  • RHSA-2020:2565 Released 2020-06-15 · Red Hat rating Important
    EAP Continuous Delivery Technical Preview Release 18 security update
    • Red Hat JBoss Enterprise Application Platform Continuous Delivery
  • RHSA-2020:2067 Released 2020-05-18 · Red Hat rating Important
    Red Hat build of Thorntail 2.5.1 security and bug fix update
    • Text-Only RHOAR
  • RHSA-2020:1445 Released 2020-04-14 · Red Hat rating Important
    Red Hat AMQ Broker 7.4.3 release and security update
    • Red Hat AMQ 7.4.3
  • RHSA-2020:0983 Released 2020-03-26 · Red Hat rating Important
    Red Hat Fuse 7.6.0 security update
    • Red Hat Fuse 7.6.0
  • RHSA-2020:0922 Released 2020-03-23 · Red Hat rating Important
    Red Hat AMQ Broker 7.6 release and security update
    • Red Hat AMQ
  • RHSA-2020:0727 Released 2020-03-05 · Red Hat rating Important
    Red Hat Data Grid 7.3.3 security update
    • Red Hat Data Grid 7.3.3
  • RHSA-2019:4352 Released 2019-12-19 · Red Hat rating Important
    Red Hat JBoss Fuse/A-MQ 6.3 R14 security and bug fix update
    • Red Hat Fuse 6.3
  • RHSA-2019:4045 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update
    • Red Hat Single Sign-On 7.3
  • RHSA-2019:4042 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 8
    • Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el8sso
  • RHSA-2019:4040 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 6
    • Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el6sso
  • RHSA-2019:4041 Released 2019-12-02 · Red Hat rating Important
    Red Hat Single Sign-On 7.3.5 security update on RHEL 7
    • Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak-4.8.15-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server-4.8.15-1.Final_redhat_00001.1.el7sso
  • RHSA-2019:4019 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update
    • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el7eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el7eap +47
  • RHSA-2019:4021 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 security update
    • Red Hat JBoss EAP 7.2
  • RHSA-2019:4020 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update
    • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-apache-cxf-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el8eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el8eap +47
  • RHSA-2019:4018 Released 2019-11-26 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update
    • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-apache-cxf-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-rt-3.2.10-1.redhat_00001.1.el6eap, eap7-apache-cxf-services-3.2.10-1.redhat_00001.1.el6eap +47
  • RHSA-2019:3892 Released 2019-11-14 · Red Hat rating Important
    Red Hat Fuse 7.5.0 security update
    • Red Hat Fuse 7.5.0
  • RHSA-2019:2955 Released 2019-10-02 · Red Hat rating Important
    rh-nodejs8-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
  • RHSA-2019:2939 Released 2019-10-01 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
  • RHSA-2019:2925 Released 2019-09-30 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x::nodejs:10 +15
  • RHSA-2019:2861 Released 2019-09-26 · Red Hat rating Important
    OpenShift Container Platform 4.1.18 gRPC security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-sriov-network-device-plugin
  • RHSA-2019:2796 Released 2019-09-19 · Red Hat rating Important
    skydive security update
    • Red Hat OpenStack Platform 14.0 skydive-0.20.5-2.el7ost, skydive-agent-0.20.5-2.el7ost, skydive-analyzer-0.20.5-2.el7ost +2
  • RHSA-2019:2766 Released 2019-09-12 · Red Hat rating Important
    Red Hat OpenShift Enterprise 4.1.15 gRPC security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-multus-cni, openshift4/ose-operator-lifecycle-manager, openshift4/ose-operator-registry

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat AMQFixed RHSA-2020:0922
Red Hat AMQ 7.4.3Fixed RHSA-2020:1445
Red Hat Data Grid 7.3.3Fixed RHSA-2020:0727
Red Hat Decision Manager 7Fixed RHSA-2020:3196
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:2925
Red Hat Fuse 6.3Fixed RHSA-2019:4352
Red Hat Fuse 7.5.0Fixed RHSA-2019:3892
Red Hat Fuse 7.6.0Fixed RHSA-2020:0983
Red Hat JBoss EAP 7.2Fixed RHSA-2019:4021
Red Hat JBoss EAP 7.2 for RHEL 6 ServerFixed RHSA-2019:4018
Red Hat JBoss EAP 7.2 for RHEL 7 ServerFixed RHSA-2019:4019
Red Hat JBoss EAP 7.2 for RHEL 8Fixed RHSA-2019:4020
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:5856
Red Hat JBoss Enterprise Application Platform Continuous DeliveryFixed RHSA-2020:2565
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2019:2766, RHSA-2019:2861
Red Hat OpenStack Platform 14.0Fixed RHSA-2019:2796
Red Hat Process Automation 7Fixed RHSA-2020:3197
Red Hat Single Sign-On 7.3Fixed RHSA-2019:4045
Red Hat Single Sign-On 7.3 for RHEL 6 ServerFixed RHSA-2019:4040
Red Hat Single Sign-On 7.3 for RHEL 7 ServerFixed RHSA-2019:4041
Red Hat Single Sign-On 7.3 for RHEL 8Fixed RHSA-2019:4042
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2939, RHSA-2019:2955
Text-Only RHOARFixed RHSA-2020:2067
Not affected: 16 products
  • CloudForms Management Engine 5
  • OpenShift Service Mesh Tech Preview
  • Red Hat Ansible Tower 3
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat OpenShift Container Platform 3.10
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 3.9
  • Red Hat OpenShift Container Platform 4
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9515
  2. 2026-10-03 Alias added: GHSA-9259-5376-vjcj

References

Advisory 34

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences