CVE-2019-9517

Published: Aug 13, 2019Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Affected (40)

Products: Apple: Swiftnio · Apache: Http Server, Traffic Server · Canonical: Ubuntu Linux · +9 more

Show all products

1 product

2 products

1 product

1 product

3 products

1 product

1 product

6 products

Jboss Enterprise Application Platform

Openshift Service Mesh

Quay

Software Collections

Oracle

4 products

Communications Element Manager

Graalvm

Instantis Enterprisetrack

Retail Xstore Point Of Service

1 product

1 product

1 product

Configuration A

1 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Apple Swiftnio	From 1.0.0 to 1.4.0

Running on/with	Platform Versions
Apple Mac Os X	From 10.12
Canonical Ubuntu Linux	From 14.04

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Apache Http Server	From 2.4.20 to 2.4.40
Apache Traffic Server	From 6.0.0 to 6.2.3
Apache Traffic Server	From 7.0.0 to 7.1.6
Apache Traffic Server	From 8.0.0 to 8.0.3

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Synology Diskstation Manager	Version 6.2
Synology Skynas	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Vs960hd Firmware	All versions

Running on/with	Platform Versions
Synology Vs960hd	All versions

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 29
Fedoraproject Fedora	Version 30

Configuration H

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 15.0
Opensuse Leap	Version 15.1

Configuration I

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Jboss Core Services	Version 1.0
Redhat Jboss Enterprise Application Platform	Version 7.2.0
Redhat Jboss Enterprise Application Platform	Version 7.3.0
Redhat Openshift Service Mesh	Version 1.0
Redhat Quay	Version 3.0.0
Redhat Software Collections	Version 1.0

Configuration J

7 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Element Manager	Version 8.0.0
Oracle Communications Element Manager	Version 8.1.0
Oracle Communications Element Manager	Version 8.1.1
Oracle Communications Element Manager	Version 8.2.0
Oracle Graalvm	Version 19.2.0
Oracle Instantis Enterprisetrack	From 17.1 to 17.3
Oracle Retail Xstore Point Of Service	Version 7.1

Configuration K

3 vulnerable

Vulnerable Software	Affected Versions
Mcafee Web Gateway	From 7.7.2.0 to 7.7.2.24
Mcafee Web Gateway	From 7.8.2.0 to 7.8.2.13
Mcafee Web Gateway	From 8.1.0 to 8.2.0

Configuration L

1 vulnerable

Vulnerable Software	Affected Versions
Netapp Clustered Data Ontap	All versions

Configuration M

5 vulnerable

Vulnerable Software	Affected Versions
Nodejs Node.js	From 10.0.0 to 10.12.0
Nodejs Node.js	From 12.0.0 to 12.8.1
Nodejs Node.js	From 8.0.0 to 8.8.1
Nodejs Node.js	From 10.13.0 to 10.16.3
Nodejs Node.js	From 8.9.0 to 8.16.1

Related CWEs

CWE-400

Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (94)

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Source: cret@cert.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2019/08/15/7

Source: cret@cert.org

Mailing ListThird Party Advisory

https://access.redhat.com/errata/RHSA-2019:2893

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2925

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2939

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2946

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2949

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2950

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:2955

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3932

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3933

Source: cret@cert.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2019:3935

Source: cret@cert.org

Third Party Advisory

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Source: cret@cert.org

Third Party Advisory

https://kb.cert.org/vuls/id/605641/

Source: cret@cert.org

Third Party AdvisoryUS Government Resource

https://kc.mcafee.com/corporate/index?page=content&id=SB10296

Source: cret@cert.org

Third Party Advisory

https://lists.apache.org/thread.html/4610762456644181b267c846423b3a990bd4aaea1886ecc7d51febdb%40%3Cannounce.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/d89f999e26dfb1d50f247ead1fe8538014eb412b2dbe5be4b1a9ef50%40%3Cdev.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/ec97fdfc1a859266e56fef084353a34e0a0b08901b3c1aa317a43c8c%40%3Cdev.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E

Source: cret@cert.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/

Source: cret@cert.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/

Source: cret@cert.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/

Source: cret@cert.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/

Source: cret@cert.org

https://seclists.org/bugtraq/2019/Aug/47

Source: cret@cert.org

Mailing ListThird Party Advisory

https://security.gentoo.org/glsa/201909-04

Source: cret@cert.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190823-0003/

Source: cret@cert.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190823-0005/

Source: cret@cert.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20190905-0003/

Source: cret@cert.org

Third Party Advisory

https://support.f5.com/csp/article/K02591030

Source: cret@cert.org

Third Party Advisory

https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSS

Source: cret@cert.org

https://usn.ubuntu.com/4113-1/

Source: cret@cert.org

Third Party Advisory

https://www.debian.org/security/2019/dsa-4509

Source: cret@cert.org

Third Party Advisory

https://www.oracle.com/security-alerts/cpuapr2020.html

Source: cret@cert.org

Third Party Advisory

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Source: cret@cert.org

PatchThird Party Advisory

https://www.synology.com/security/advisory/Synology_SA_19_33

Source: cret@cert.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html