Read the docs
TI-2019-06951 Aliases CVE-2019-9516GHSA-6gw7-c226-vg73

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a…

Priority MEDIUM 62CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 16 fixed, 5 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Why it matters now

EPSS 0.57461 99th percentileScored 2026-11-07
Fix Partial Red Hat: 16 advisoriesRed Hat: 16 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:*1.0.0 – 1.4.0VulnerableApple
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*10.12Running onApple
cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*14.04Running onCanonical
cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:*6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3VulnerableApache
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
  • cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.0 Vulnerable ·Apple
  • cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.12 Running on ·Apple
  • cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* Versions 14.04 Running on ·Canonical
  • cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3 Vulnerable ·Apache
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:*6.2VulnerableSynology
cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableSynology
cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:*not specified by NVDRunning onSynology
cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*29VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*15.0VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:*7.2.0VulnerableRed Hat
cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:*7.3.0VulnerableRed Hat
cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*1.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:*19.2.0VulnerableOracle
cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:*7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0VulnerableMcAfee
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*1.9.5 to before 1.16.1; 1.17.0 – 1.17.2VulnerableF5
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*8.0.0 to before 8.16.1; 10.0.0 to before 10.16.3VulnerableNodeJS
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*12.0.0 to before 12.8.1VulnerableNodeJS
  • cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Synology
  • cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
  • cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
  • cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
  • cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:* Versions 19.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0 Vulnerable ·McAfee
  • cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* Versions 1.9.5 to before 1.16.1; 1.17.0 – 1.17.2 Vulnerable ·F5
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 8.0.0 to before 8.16.1; 10.0.0 to before 10.16.3 Vulnerable ·NodeJS
  • cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 to before 12.8.1 Vulnerable ·NodeJS

Remediation

Red Hat 16 advisories

  • RHSA-2020:1445 Released 2020-04-14 · Red Hat rating Important
    Red Hat AMQ Broker 7.4.3 release and security update
    • Red Hat AMQ 7.4.3
  • RHSA-2020:0983 Released 2020-03-26 · Red Hat rating Important
    Red Hat Fuse 7.6.0 security update
    • Red Hat Fuse 7.6.0
  • RHSA-2020:0922 Released 2020-03-23 · Red Hat rating Important
    Red Hat AMQ Broker 7.6 release and security update
    • Red Hat AMQ
Show 13 more Red Hat advisories
  • RHSA-2019:3932 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el6 +37
  • RHSA-2019:3933 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7 +37
  • RHSA-2019:3935 Released 2019-11-20 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
    • Red Hat JBoss Core Services
  • RHSA-2019:2966 Released 2019-10-03 · Red Hat rating Important
    Red Hat Quay v3.1.1 security update
    • Quay v3 quay3/clair-jwt
  • RHSA-2019:2955 Released 2019-10-02 · Red Hat rating Important
    rh-nodejs8-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
  • RHSA-2019:2946 Released 2019-10-01 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update
    • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el6 +8
    • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el7 +8
  • RHSA-2019:2950 Released 2019-10-01 · Red Hat rating Important
    Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update
    • Red Hat JBoss Core Services
  • RHSA-2019:2939 Released 2019-10-01 · Red Hat rating Important
    rh-nodejs10-nodejs security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
  • RHSA-2019:2925 Released 2019-09-30 · Red Hat rating Important
    nodejs:10 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x::nodejs:10 +15
  • RHSA-2019:2799 Released 2019-09-19 · Red Hat rating Important
    nginx:1.14 security update
    • Red Hat Enterprise Linux AppStream (v. 8) nginx-1:1.14.1-9.module+el8.0.0+4108+af250afe.aarch64::nginx:1.14, nginx-1:1.14.1-9.module+el8.0.0+4108+af250afe.ppc64le::nginx:1.14, nginx-1:1.14.1-9.module+el8.0.0+4108+af250afe.s390x::nginx:1.14 +24
  • RHSA-2019:2775 Released 2019-09-17 · Red Hat rating Important
    rh-nginx114-nginx security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx114-nginx-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-image-filter-1:1.14.1-1.el7.1, rh-nginx114-nginx-mod-http-perl-1:1.14.1-1.el7.1 +3
  • RHSA-2019:2746 Released 2019-09-13 · Red Hat rating Important
    rh-nginx112-nginx security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx112-nginx-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-image-filter-1:1.12.1-3.el7.1, rh-nginx112-nginx-mod-http-perl-1:1.12.1-3.el7.1 +3
  • RHSA-2019:2745 Released 2019-09-13 · Red Hat rating Important
    rh-nginx110-nginx security update
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-nginx110-nginx-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el6.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-nginx110-nginx-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el6.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el6.1 +3
    • Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nginx110-nginx-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-image-filter-1:1.10.2-9.el7.1, rh-nginx110-nginx-mod-http-perl-1:1.10.2-9.el7.1 +3

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat JBoss Enterprise Web Server 3AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Quay v3Fixed RHSA-2019:2966
Red Hat AMQFixed RHSA-2020:0922
Red Hat AMQ 7.4.3Fixed RHSA-2020:1445
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:2799, RHSA-2019:2925
Red Hat Fuse 7.6.0Fixed RHSA-2020:0983
Red Hat JBoss Core ServicesFixed RHSA-2019:2950
Red Hat JBoss Core Services on RHEL 6 ServerFixed RHSA-2019:2946, RHSA-2019:3932
Red Hat JBoss Core Services on RHEL 7 ServerFixed RHSA-2019:2946, RHSA-2019:3933
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2019:2745
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2955
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2019:2745
Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2019:2745, RHSA-2019:2746, RHSA-2019:2775, RHSA-2019:2939, RHSA-2019:2955
Not affected: 17 products
  • CloudForms Management Engine 5
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Tower 3
  • Red Hat Enterprise Linux 8
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 6
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Web Server 5
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 3.10
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 3.9
  • Red Hat OpenShift Container Platform 4
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Single Sign-On 7
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-9516
  2. 2026-10-03 Alias added: GHSA-6gw7-c226-vg73

References

Advisory 36

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences