CVE-2019-9517

high-risk
Published 2019-08-13

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Do I need to act?

~
6.0% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Debian Redhat Apache Apple Oracle Mcafee Canonical Fedoraproject Netapp Opensuse Synology Nodejs

References (94)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
Mailing List http://www.openwall.com/lists/oss-security/2019/08/15/7
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2893
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2925
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2939
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2946
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2949
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2950
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:2955
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3932
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3933
Third Party Advisory https://access.redhat.com/errata/RHSA-2019:3935
Third Party Advisory https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party...
Third Party Advisory https://kb.cert.org/vuls/id/605641/
Third Party Advisory https://kc.mcafee.com/corporate/index?page=content&id=SB10296
https://lists.apache.org/thread.html/4610762456644181b267c846423b3a990bd4aaea188...
https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cd...
https://lists.apache.org/thread.html/d89f999e26dfb1d50f247ead1fe8538014eb412b2db...
and 74 more references
58
/ 100
high-risk
Severity 26/34 · High
Exploitability 9/34 · Low
Exposure 23/34 · High