CVE Feed

    Dashboard / CVE / CVE-2019-9512

    CVE-2019-9512

    Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

    Published:Aug 13, 2019
    Last Modified:Nov 21, 2024
    EPS:Aug 13, 2019
    EPSS Score:0.17862
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Traffic Server
    Vendor
    Apple
    Product
    Mac Os X
    Vendor
    Apple
    Product
    Swiftnio
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Redhat
    Product
    Amq Broker
    Vendor
    Redhat
    Product
    Devtools
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Jboss Data Grid
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Cd
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Eus
    Vendor
    Redhat
    Product
    Jboss Enterprise Bpms Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Brms Platform
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Single Sign On
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Openshift Application Runtimes
    Vendor
    Redhat
    Product
    Openstack
    Vendor
    Redhat
    Product
    Quay
    Vendor
    Redhat
    Product
    Red Hat Single Sign On
    Vendor
    Redhat
    Product
    Rhel Extras Other
    Vendor
    Redhat
    Product
    Rhel Software Collections

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-65100 (CVSS 6.3) — Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded succes…
    CVE-2026-58189 (CVSS 8.2) — Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplifi…
    CVE-2026-58188 (CVSS 8.4) — Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue aff…
    CVE-2026-58186 (CVSS 8.2) — The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.…
    CVE-2026-58185 (CVSS 8.2) — The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: fr…
    CVE-2026-58184 (CVSS 8.3) — The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR …
    CVE-2026-58183 (CVSS 8.2) — The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue aff…
    CVE-2026-58182 (CVSS 8.2) — The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. …
    CVE-2026-58181 (CVSS 8.2) — The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. T…
    CVE-2026-58180 (CVSS 8.2) — The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affec…

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
    http://seclists.org/fulldisclosure/2019/Aug/16
    http://www.openwall.com/lists/oss-security/2019/08/20/1
    https://access.redhat.com/errata/RHSA-2019:2594
    https://access.redhat.com/errata/RHSA-2019:2661
    https://access.redhat.com/errata/RHSA-2019:2682
    https://access.redhat.com/errata/RHSA-2019:2690
    https://access.redhat.com/errata/RHSA-2019:2726
    https://access.redhat.com/errata/RHSA-2019:2766
    https://access.redhat.com/errata/RHSA-2019:2769
    https://access.redhat.com/errata/RHSA-2019:2796
    https://access.redhat.com/errata/RHSA-2019:2861
    https://access.redhat.com/errata/RHSA-2019:2925
    https://access.redhat.com/errata/RHSA-2019:2939
    https://access.redhat.com/errata/RHSA-2019:2955
    https://access.redhat.com/errata/RHSA-2019:2966
    https://access.redhat.com/errata/RHSA-2019:3131
    https://access.redhat.com/errata/RHSA-2019:3245
    https://access.redhat.com/errata/RHSA-2019:3265
    https://access.redhat.com/errata/RHSA-2019:3892
    https://access.redhat.com/errata/RHSA-2019:3906
    https://access.redhat.com/errata/RHSA-2019:4018
    https://access.redhat.com/errata/RHSA-2019:4019
    https://access.redhat.com/errata/RHSA-2019:4020
    https://access.redhat.com/errata/RHSA-2019:4021
    https://access.redhat.com/errata/RHSA-2019:4040
    https://access.redhat.com/errata/RHSA-2019:4041
    https://access.redhat.com/errata/RHSA-2019:4042
    https://access.redhat.com/errata/RHSA-2019:4045
    https://access.redhat.com/errata/RHSA-2019:4269
    https://access.redhat.com/errata/RHSA-2019:4273
    https://access.redhat.com/errata/RHSA-2019:4352
    https://access.redhat.com/errata/RHSA-2020:0406
    https://access.redhat.com/errata/RHSA-2020:0727
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    https://kb.cert.org/vuls/id/605641/
    https://kc.mcafee.com/corporate/index?page=content&id=SB10296
    https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
    https://seclists.org/bugtraq/2019/Aug/24
    https://seclists.org/bugtraq/2019/Aug/31
    https://seclists.org/bugtraq/2019/Aug/43
    https://seclists.org/bugtraq/2019/Sep/18
    https://security.netapp.com/advisory/ntap-20190823-0001/
    https://security.netapp.com/advisory/ntap-20190823-0004/
    https://security.netapp.com/advisory/ntap-20190823-0005/
    https://support.f5.com/csp/article/K98053339
    https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4308-1/
    https://www.debian.org/security/2019/dsa-4503
    https://www.debian.org/security/2019/dsa-4508
    https://www.debian.org/security/2019/dsa-4520
    https://www.synology.com/security/advisory/Synology_SA_19_33
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
    http://seclists.org/fulldisclosure/2019/Aug/16
    http://www.openwall.com/lists/oss-security/2019/08/20/1
    https://access.redhat.com/errata/RHSA-2019:2594
    https://access.redhat.com/errata/RHSA-2019:2661
    https://access.redhat.com/errata/RHSA-2019:2682
    https://access.redhat.com/errata/RHSA-2019:2690
    https://access.redhat.com/errata/RHSA-2019:2726
    https://access.redhat.com/errata/RHSA-2019:2766
    https://access.redhat.com/errata/RHSA-2019:2769
    https://access.redhat.com/errata/RHSA-2019:2796
    https://access.redhat.com/errata/RHSA-2019:2861
    https://access.redhat.com/errata/RHSA-2019:2925
    https://access.redhat.com/errata/RHSA-2019:2939
    https://access.redhat.com/errata/RHSA-2019:2955
    https://access.redhat.com/errata/RHSA-2019:2966
    https://access.redhat.com/errata/RHSA-2019:3131
    https://access.redhat.com/errata/RHSA-2019:3245
    https://access.redhat.com/errata/RHSA-2019:3265
    https://access.redhat.com/errata/RHSA-2019:3892
    https://access.redhat.com/errata/RHSA-2019:3906
    https://access.redhat.com/errata/RHSA-2019:4018
    https://access.redhat.com/errata/RHSA-2019:4019
    https://access.redhat.com/errata/RHSA-2019:4020
    https://access.redhat.com/errata/RHSA-2019:4021
    https://access.redhat.com/errata/RHSA-2019:4040
    https://access.redhat.com/errata/RHSA-2019:4041
    https://access.redhat.com/errata/RHSA-2019:4042
    https://access.redhat.com/errata/RHSA-2019:4045
    https://access.redhat.com/errata/RHSA-2019:4269
    https://access.redhat.com/errata/RHSA-2019:4273
    https://access.redhat.com/errata/RHSA-2019:4352
    https://access.redhat.com/errata/RHSA-2020:0406
    https://access.redhat.com/errata/RHSA-2020:0727
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    https://kb.cert.org/vuls/id/605641/
    https://kc.mcafee.com/corporate/index?page=content&id=SB10296
    https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
    https://seclists.org/bugtraq/2019/Aug/24
    https://seclists.org/bugtraq/2019/Aug/31
    https://seclists.org/bugtraq/2019/Aug/43
    https://seclists.org/bugtraq/2019/Sep/18
    https://security.netapp.com/advisory/ntap-20190823-0001/
    https://security.netapp.com/advisory/ntap-20190823-0004/
    https://security.netapp.com/advisory/ntap-20190823-0005/
    https://support.f5.com/csp/article/K98053339
    https://support.f5.com/csp/article/K98053339?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4308-1/
    https://www.debian.org/security/2019/dsa-4503
    https://www.debian.org/security/2019/dsa-4508
    https://www.debian.org/security/2019/dsa-4520
    https://www.synology.com/security/advisory/Synology_SA_19_33

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High