Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 14 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-400.
Summary
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 39
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:* | 1.0.0 – 1.4.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* | 10.12 | Running on | Apple |
| cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* | 14.04 | Running on | Canonical |
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.4.20 to before 2.4.40 | Vulnerable | Apache |
| cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* | 6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3 | Vulnerable | Apache |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:apple:swiftnio:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.4.0 Vulnerable ·Apple
- cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* Versions 10.12 Running on ·Apple
- cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:* Versions 14.04 Running on ·Canonical
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.4.20 to before 2.4.40 Vulnerable ·Apache
- cpe:2.3:a:apache:traffic_server:*:*:*:*:*:*:*:* Versions 6.0.0 – 6.2.3; 7.0.0 – 7.1.6; 8.0.0 – 8.0.3 Vulnerable ·Apache
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Show 29 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Synology |
| cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* | 6.2 | Vulnerable | Synology |
| cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Synology |
| cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Synology |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* | 7.2.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* | 7.3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:* | 8.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:* | 8.1.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* | 8.1.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* | 8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:* | 19.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* | 17.1 – 17.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
| cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* | 7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0 | Vulnerable | McAfee |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 8.0.0 – 8.8.1 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | 8.9.0 to before 8.16.1 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 10.0.0 – 10.12.0 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* | 10.13.0 to before 10.16.3 | Vulnerable | NodeJS |
| cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* | 12.0.0 to before 12.8.1 | Vulnerable | NodeJS |
- cpe:2.3:a:synology:skynas:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
- cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Synology
- cpe:2.3:o:synology:vs960hd_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Synology
- cpe:2.3:h:synology:vs960hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Synology
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:redhat:jboss_core_services:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.2.0:*:*:*:*:*:*:* Versions 7.2.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:7.3.0:*:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_service_mesh:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:quay:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:a:oracle:communications_element_manager:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:graalvm:19.2.0:*:*:*:enterprise:*:*:* Versions 19.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:instantis_enterprisetrack:*:*:*:*:*:*:*:* Versions 17.1 – 17.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
- cpe:2.3:a:mcafee:web_gateway:*:*:*:*:*:*:*:* Versions 7.7.2.0 to before 7.7.2.24; 7.8.2.0 to before 7.8.2.13; 8.1.0 to before 8.2.0 Vulnerable ·McAfee
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 8.0.0 – 8.8.1 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 8.9.0 to before 8.16.1 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 10.0.0 – 10.12.0 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:* Versions 10.13.0 to before 10.16.3 Vulnerable ·NodeJS
- cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:* Versions 12.0.0 to before 12.8.1 Vulnerable ·NodeJS
Remediation
Red Hat 13 advisories
- RHSA-2020:1445 Released 2020-04-14 · Red Hat rating ImportantRed Hat AMQ Broker 7.4.3 release and security update
- Red Hat AMQ 7.4.3
- RHSA-2020:0983 Released 2020-03-26 · Red Hat rating ImportantRed Hat Fuse 7.6.0 security update
- Red Hat Fuse 7.6.0
- RHSA-2020:0922 Released 2020-03-23 · Red Hat rating ImportantRed Hat AMQ Broker 7.6 release and security update
- Red Hat AMQ
Show 10 more Red Hat advisories
- RHSA-2019:3932 Released 2019-11-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el6, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el6 +37
- RHSA-2019:3933 Released 2019-11-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-apr-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-devel-1.6.3-63.jbcs.el7, jbcs-httpd24-apr-util-1.6.1-48.jbcs.el7 +37
- RHSA-2019:3935 Released 2019-11-20 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release
- Red Hat JBoss Core Services
- RHSA-2019:2955 Released 2019-10-02 · Red Hat rating Importantrh-nodejs8-nodejs security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8-3.0-5.el7, rh-nodejs8-nodejs-8.16.1-2.el7, rh-nodejs8-nodejs-devel-8.16.1-2.el7 +4
- RHSA-2019:2949 Released 2019-10-01 · Red Hat rating Importanthttpd24-httpd and httpd24-nghttp2 security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) httpd24-httpd-2.4.34-8.el6.1, httpd24-httpd-devel-2.4.34-8.el6.1, httpd24-httpd-manual-2.4.34-8.el6.1 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) httpd24-httpd-2.4.34-8.el6.1, httpd24-httpd-devel-2.4.34-8.el6.1, httpd24-httpd-manual-2.4.34-8.el6.1 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) httpd24-httpd-2.4.34-8.el7.1, httpd24-httpd-devel-2.4.34-8.el7.1, httpd24-httpd-manual-2.4.34-8.el7.1 +9
- RHSA-2019:2946 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el6, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el6 +8
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-httpd-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.29-41.jbcs.el7, jbcs-httpd24-httpd-manual-2.4.29-41.jbcs.el7 +8
- RHSA-2019:2950 Released 2019-10-01 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update
- Red Hat JBoss Core Services
- RHSA-2019:2939 Released 2019-10-01 · Red Hat rating Importantrh-nodejs10-nodejs security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs10-3.2-3.el7, rh-nodejs10-nodejs-10.16.3-3.el7, rh-nodejs10-nodejs-devel-10.16.3-3.el7 +4
- RHSA-2019:2925 Released 2019-09-30 · Red Hat rating Importantnodejs:10 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.aarch64::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.ppc64le::nodejs:10, nodejs-1:10.16.3-2.module+el8.0.0+4214+49953fda.s390x::nodejs:10 +15
- RHSA-2019:2893 Released 2019-09-24 · Red Hat rating Importanthttpd:2.4 security update
- Red Hat Enterprise Linux AppStream (v. 8) httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.aarch64::httpd:2.4, httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.ppc64le::httpd:2.4, httpd-2.4.37-12.module+el8.0.0+4096+eb40e6da.s390x::httpd:2.4 +37
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat AMQ Broker 7 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet |
| Red Hat JBoss Enterprise Web Server 3 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Application Runtimes | Affected | No fix planned: Out of support scope |
| Red Hat AMQ | Fixed | RHSA-2020:0922 |
| Red Hat AMQ 7.4.3 | Fixed | RHSA-2020:1445 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:2893, RHSA-2019:2925 |
| Red Hat Fuse 7.6.0 | Fixed | RHSA-2020:0983 |
| Red Hat JBoss Core Services | Fixed | RHSA-2019:2950 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2019:2946, RHSA-2019:3932 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2019:2946, RHSA-2019:3933 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2019:2949 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) | Fixed | RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) | Fixed | RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2019:2949 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:2939, RHSA-2019:2949, RHSA-2019:2955 |
Not affected: 15 products
- CloudForms Management Engine 5
- Red Hat Ansible Tower 3
- Red Hat Enterprise Linux 8
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Web Server 5
- Red Hat OpenShift Application Runtimes
- Red Hat OpenShift Container Platform 3.10
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 3.9
- Red Hat OpenShift Container Platform 4
- Red Hat Process Automation 7
- Red Hat Quay 3
- Red Hat Single Sign-On 7
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9517
- 2026-10-03 Alias added: GHSA-w6v5-q8c8-52xx
References
Advisory 31
- VU#605641
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- [oss-security] 20190814 CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workers
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://security.netapp.com/advisory/ntap-20190823-0003/
- FEDORA-2019-5a6a7bc12c
- FEDORA-2019-6a2980de56
- DSA-4509
- 20190826 [SECURITY] [DSA 4509-1] apache2 security update
- USN-4113-1
- FEDORA-2019-4427fd65be
- FEDORA-2019-63ba15cc83
- openSUSE-SU-2019:2051
- https://security.netapp.com/advisory/ntap-20190905-0003/
- GLSA-201909-04
- openSUSE-SU-2019:2114
- openSUSE-SU-2019:2115
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- RHSA-2019:2893
- RHSA-2019:2925
- RHSA-2019:2939
- RHSA-2019:2946
- RHSA-2019:2950
- RHSA-2019:2949
- RHSA-2019:2955
- RHSA-2019:3933
- RHSA-2019:3935
- RHSA-2019:3932
- https://www.oracle.com/security-alerts/cpuapr2020.html
Other 15
- [httpd-announce] 20190814 CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workers
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-dev] 20190817 CVE-2019-10097 vs. CHANGEs entry
- [httpd-dev] 20190817 Re: CVE-2019-10097 vs. CHANGEs entry
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1888194 [12/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Sources
- CVE-2019-9517 · CVE Program
- CVE-2019-9517 · NVD
- FIRST EPSS
- GHSA-w6v5-q8c8-52xx · GitHub Advisory Database · CC BY 4.0
- CVE-2019-9517 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences