CVE Feed

    Dashboard / CVE / CVE-2019-9511

    CVE-2019-9511

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

    Published:Aug 13, 2019
    Last Modified:Jan 14, 2025
    EPS:Aug 13, 2019
    EPSS Score:0.15262
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Traffic Server
    Vendor
    Apple
    Product
    Mac Os X
    Vendor
    Apple
    Product
    Swiftnio
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    F5
    Product
    Nginx
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Mcafee
    Product
    Web Gateway
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Oracle
    Product
    Enterprise Communications Broker
    Vendor
    Oracle
    Product
    Graalvm
    Vendor
    Redhat
    Product
    Amq Broker
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Core Services
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Cd
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Eus
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Openshift Application Runtimes
    Vendor
    Redhat
    Product
    Openshift Service Mesh
    Vendor
    Redhat
    Product
    Quay
    Vendor
    Redhat
    Product
    Rhel Software Collections
    Vendor
    Redhat
    Product
    Service Mesh
    Vendor
    Redhat
    Product
    Software Collections
    Vendor
    Synology
    Product
    Diskstation Manager
    Vendor
    Synology
    Product
    Skynas
    Vendor
    Synology
    Product
    Vs960hd
    Vendor
    Synology
    Product
    Vs960hd Firmware

    Exploits

    https://github.com/flyniu666/ingress-nginx-0.21-1.19.5https://github.com/harley-ghostie/CVE-2019-9511_Priority-Churn-Data-Dribble

    Related CVEs

    CVE-2026-65100 (CVSS 6.3) — Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded succes…
    CVE-2026-58189 (CVSS 8.2) — Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplifi…
    CVE-2026-58188 (CVSS 8.4) — Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue aff…
    CVE-2026-58186 (CVSS 8.2) — The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.…
    CVE-2026-58185 (CVSS 8.2) — The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: fr…
    CVE-2026-58184 (CVSS 8.3) — The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR …
    CVE-2026-58183 (CVSS 8.2) — The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue aff…
    CVE-2026-58182 (CVSS 8.2) — The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. …
    CVE-2026-58181 (CVSS 8.2) — The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. T…
    CVE-2026-58180 (CVSS 8.2) — The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affec…

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
    http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html
    http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html
    http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
    https://access.redhat.com/errata/RHSA-2019:2692
    https://access.redhat.com/errata/RHSA-2019:2745
    https://access.redhat.com/errata/RHSA-2019:2746
    https://access.redhat.com/errata/RHSA-2019:2775
    https://access.redhat.com/errata/RHSA-2019:2799
    https://access.redhat.com/errata/RHSA-2019:2925
    https://access.redhat.com/errata/RHSA-2019:2939
    https://access.redhat.com/errata/RHSA-2019:2949
    https://access.redhat.com/errata/RHSA-2019:2955
    https://access.redhat.com/errata/RHSA-2019:2966
    https://access.redhat.com/errata/RHSA-2019:3041
    https://access.redhat.com/errata/RHSA-2019:3932
    https://access.redhat.com/errata/RHSA-2019:3933
    https://access.redhat.com/errata/RHSA-2019:3935
    https://access.redhat.com/errata/RHSA-2019:4018
    https://access.redhat.com/errata/RHSA-2019:4019
    https://access.redhat.com/errata/RHSA-2019:4020
    https://access.redhat.com/errata/RHSA-2019:4021
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    https://kb.cert.org/vuls/id/605641/
    https://kc.mcafee.com/corporate/index?page=content&id=SB10296
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
    https://seclists.org/bugtraq/2019/Aug/40
    https://seclists.org/bugtraq/2019/Sep/1
    https://security.netapp.com/advisory/ntap-20190823-0002/
    https://security.netapp.com/advisory/ntap-20190823-0005/
    https://support.f5.com/csp/article/K02591030
    https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4099-1/
    https://www.debian.org/security/2019/dsa-4505
    https://www.debian.org/security/2019/dsa-4511
    https://www.debian.org/security/2020/dsa-4669
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://www.synology.com/security/advisory/Synology_SA_19_33
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html
    http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html
    http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html
    http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html
    https://access.redhat.com/errata/RHSA-2019:2692
    https://access.redhat.com/errata/RHSA-2019:2745
    https://access.redhat.com/errata/RHSA-2019:2746
    https://access.redhat.com/errata/RHSA-2019:2775
    https://access.redhat.com/errata/RHSA-2019:2799
    https://access.redhat.com/errata/RHSA-2019:2925
    https://access.redhat.com/errata/RHSA-2019:2939
    https://access.redhat.com/errata/RHSA-2019:2949
    https://access.redhat.com/errata/RHSA-2019:2955
    https://access.redhat.com/errata/RHSA-2019:2966
    https://access.redhat.com/errata/RHSA-2019:3041
    https://access.redhat.com/errata/RHSA-2019:3932
    https://access.redhat.com/errata/RHSA-2019:3933
    https://access.redhat.com/errata/RHSA-2019:3935
    https://access.redhat.com/errata/RHSA-2019:4018
    https://access.redhat.com/errata/RHSA-2019:4019
    https://access.redhat.com/errata/RHSA-2019:4020
    https://access.redhat.com/errata/RHSA-2019:4021
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    https://kb.cert.org/vuls/id/605641/
    https://kc.mcafee.com/corporate/index?page=content&id=SB10296
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
    https://seclists.org/bugtraq/2019/Aug/40
    https://seclists.org/bugtraq/2019/Sep/1
    https://security.netapp.com/advisory/ntap-20190823-0002/
    https://security.netapp.com/advisory/ntap-20190823-0005/
    https://support.f5.com/csp/article/K02591030
    https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4099-1/
    https://www.debian.org/security/2019/dsa-4505
    https://www.debian.org/security/2019/dsa-4511
    https://www.debian.org/security/2020/dsa-4669
    https://www.oracle.com/security-alerts/cpujan2021.html
    https://www.oracle.com/security-alerts/cpuoct2020.html
    https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
    https://www.synology.com/security/advisory/Synology_SA_19_33

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High