CVE Feed

    Dashboard / CVE / CVE-2019-9514

    CVE-2019-9514

    Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

    Published:Aug 13, 2019
    Last Modified:Jan 14, 2025
    EPS:Aug 13, 2019
    EPSS Score:0.08832
    CVSS Score:7.5

    Affected Products

    Vendor
    Apache
    Product
    Traffic Server
    Vendor
    Apple
    Product
    Mac Os X
    Vendor
    Apple
    Product
    Swiftnio
    Vendor
    Canonical
    Product
    Ubuntu Linux
    Vendor
    Debian
    Product
    Debian Linux
    Vendor
    F5
    Product
    Big-ip Local Traffic Manager
    Vendor
    Fedoraproject
    Product
    Fedora
    Vendor
    Mcafee
    Product
    Web Gateway
    Vendor
    Netapp
    Product
    Cloud Insights
    Vendor
    Netapp
    Product
    Trident
    Vendor
    Nodejs
    Product
    Node.js
    Vendor
    Opensuse
    Product
    Leap
    Vendor
    Oracle
    Product
    Graalvm
    Vendor
    Redhat
    Product
    Amq Broker
    Vendor
    Redhat
    Product
    Developer Tools
    Vendor
    Redhat
    Product
    Devtools
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Enterprise Linux Eus
    Vendor
    Redhat
    Product
    Enterprise Linux Server
    Vendor
    Redhat
    Product
    Enterprise Linux Workstation
    Vendor
    Redhat
    Product
    Jboss Core Services
    Vendor
    Redhat
    Product
    Jboss Data Grid
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Cd
    Vendor
    Redhat
    Product
    Jboss Enterprise Application Platform Eus
    Vendor
    Redhat
    Product
    Jboss Enterprise Bpms Platform
    Vendor
    Redhat
    Product
    Jboss Enterprise Brms Platform
    Vendor
    Redhat
    Product
    Jboss Fuse
    Vendor
    Redhat
    Product
    Jboss Single Sign On
    Vendor
    Redhat
    Product
    Openshift
    Vendor
    Redhat
    Product
    Openshift Application Runtimes
    Vendor
    Redhat
    Product
    Openshift Container Platform
    Vendor
    Redhat
    Product
    Openshift Service Mesh
    Vendor
    Redhat
    Product
    Openstack
    Vendor
    Redhat
    Product
    Quay
    Vendor
    Redhat
    Product
    Red Hat Single Sign On
    Vendor
    Redhat
    Product
    Rhel Extras Other
    Vendor
    Redhat
    Product
    Rhel Software Collections
    Vendor
    Redhat
    Product
    Single Sign-on
    Vendor
    Redhat
    Product
    Software Collections
    Vendor
    Synology
    Product
    Diskstation Manager
    Vendor
    Synology
    Product
    Skynas
    Vendor
    Synology
    Product
    Vs960hd
    Vendor
    Synology
    Product
    Vs960hd Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-65100 (CVSS 6.3) — Apache Traffic Server updates the HTTP/2 HPACK dynamic table before confirming the header block encoded succes…
    CVE-2026-58189 (CVSS 8.2) — Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplifi…
    CVE-2026-58188 (CVSS 8.4) — Several Apache Traffic Server experimental plugins have memory-safety and limit-bypass errors. This issue aff…
    CVE-2026-58186 (CVSS 8.2) — The Apache Traffic Server webp_transform plugin can decode unsafely and serve mislabeled, cacheable responses.…
    CVE-2026-58185 (CVSS 8.2) — The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: fr…
    CVE-2026-58184 (CVSS 8.3) — The Apache Traffic Server header_rewrite plugin can crash or corrupt memory during cookie operations and CIDR …
    CVE-2026-58183 (CVSS 8.2) — The Apache Traffic Server prefetch plugin can crash when processing attacker-influenced input. This issue aff…
    CVE-2026-58182 (CVSS 8.2) — The Apache Traffic Server ts_lua plugin mishandles initialization, transform context, and per-instance state. …
    CVE-2026-58181 (CVSS 8.2) — The Apache Traffic Server uri_signing and url_sig plugins can exhaust the stack or crash on attacker input. T…
    CVE-2026-58180 (CVSS 8.2) — The Apache Traffic Server txn_box plugin overflows the stack from attacker-controlled input. This issue affec…

    References

    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
    http://seclists.org/fulldisclosure/2019/Aug/16
    http://www.openwall.com/lists/oss-security/2019/08/20/1
    http://www.openwall.com/lists/oss-security/2023/10/18/8
    https://access.redhat.com/errata/RHSA-2019:2594
    https://access.redhat.com/errata/RHSA-2019:2661
    https://access.redhat.com/errata/RHSA-2019:2682
    https://access.redhat.com/errata/RHSA-2019:2690
    https://access.redhat.com/errata/RHSA-2019:2726
    https://access.redhat.com/errata/RHSA-2019:2766
    https://access.redhat.com/errata/RHSA-2019:2769
    https://access.redhat.com/errata/RHSA-2019:2796
    https://access.redhat.com/errata/RHSA-2019:2861
    https://access.redhat.com/errata/RHSA-2019:2925
    https://access.redhat.com/errata/RHSA-2019:2939
    https://access.redhat.com/errata/RHSA-2019:2955
    https://access.redhat.com/errata/RHSA-2019:2966
    https://access.redhat.com/errata/RHSA-2019:3131
    https://access.redhat.com/errata/RHSA-2019:3245
    https://access.redhat.com/errata/RHSA-2019:3265
    https://access.redhat.com/errata/RHSA-2019:3892
    https://access.redhat.com/errata/RHSA-2019:3906
    https://access.redhat.com/errata/RHSA-2019:4018
    https://access.redhat.com/errata/RHSA-2019:4019
    https://access.redhat.com/errata/RHSA-2019:4020
    https://access.redhat.com/errata/RHSA-2019:4021
    https://access.redhat.com/errata/RHSA-2019:4040
    https://access.redhat.com/errata/RHSA-2019:4041
    https://access.redhat.com/errata/RHSA-2019:4042
    https://access.redhat.com/errata/RHSA-2019:4045
    https://access.redhat.com/errata/RHSA-2019:4269
    https://access.redhat.com/errata/RHSA-2019:4273
    https://access.redhat.com/errata/RHSA-2019:4352
    https://access.redhat.com/errata/RHSA-2020:0406
    https://access.redhat.com/errata/RHSA-2020:0727
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    https://kb.cert.org/vuls/id/605641/
    https://kc.mcafee.com/corporate/index?page=content&id=SB10296
    https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
    https://seclists.org/bugtraq/2019/Aug/24
    https://seclists.org/bugtraq/2019/Aug/31
    https://seclists.org/bugtraq/2019/Aug/43
    https://seclists.org/bugtraq/2019/Sep/18
    https://security.netapp.com/advisory/ntap-20190823-0001/
    https://security.netapp.com/advisory/ntap-20190823-0004/
    https://security.netapp.com/advisory/ntap-20190823-0005/
    https://support.f5.com/csp/article/K01988340
    https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4308-1/
    https://www.debian.org/security/2019/dsa-4503
    https://www.debian.org/security/2019/dsa-4508
    https://www.debian.org/security/2019/dsa-4520
    https://www.debian.org/security/2020/dsa-4669
    https://www.synology.com/security/advisory/Synology_SA_19_33
    http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
    http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
    http://seclists.org/fulldisclosure/2019/Aug/16
    http://www.openwall.com/lists/oss-security/2019/08/20/1
    http://www.openwall.com/lists/oss-security/2023/10/18/8
    https://access.redhat.com/errata/RHSA-2019:2594
    https://access.redhat.com/errata/RHSA-2019:2661
    https://access.redhat.com/errata/RHSA-2019:2682
    https://access.redhat.com/errata/RHSA-2019:2690
    https://access.redhat.com/errata/RHSA-2019:2726
    https://access.redhat.com/errata/RHSA-2019:2766
    https://access.redhat.com/errata/RHSA-2019:2769
    https://access.redhat.com/errata/RHSA-2019:2796
    https://access.redhat.com/errata/RHSA-2019:2861
    https://access.redhat.com/errata/RHSA-2019:2925
    https://access.redhat.com/errata/RHSA-2019:2939
    https://access.redhat.com/errata/RHSA-2019:2955
    https://access.redhat.com/errata/RHSA-2019:2966
    https://access.redhat.com/errata/RHSA-2019:3131
    https://access.redhat.com/errata/RHSA-2019:3245
    https://access.redhat.com/errata/RHSA-2019:3265
    https://access.redhat.com/errata/RHSA-2019:3892
    https://access.redhat.com/errata/RHSA-2019:3906
    https://access.redhat.com/errata/RHSA-2019:4018
    https://access.redhat.com/errata/RHSA-2019:4019
    https://access.redhat.com/errata/RHSA-2019:4020
    https://access.redhat.com/errata/RHSA-2019:4021
    https://access.redhat.com/errata/RHSA-2019:4040
    https://access.redhat.com/errata/RHSA-2019:4041
    https://access.redhat.com/errata/RHSA-2019:4042
    https://access.redhat.com/errata/RHSA-2019:4045
    https://access.redhat.com/errata/RHSA-2019:4269
    https://access.redhat.com/errata/RHSA-2019:4273
    https://access.redhat.com/errata/RHSA-2019:4352
    https://access.redhat.com/errata/RHSA-2020:0406
    https://access.redhat.com/errata/RHSA-2020:0727
    https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
    https://kb.cert.org/vuls/id/605641/
    https://kc.mcafee.com/corporate/index?page=content&id=SB10296
    https://lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030254c04%40%3Cusers.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d34b3c19%40%3Cannounce.trafficserver.apache.org%3E
    https://lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0eee0a7%40%3Cdev.trafficserver.apache.org%3E
    https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
    https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LYO6E3H34C346D2E443GLXK7OK6KIYIQ/
    https://seclists.org/bugtraq/2019/Aug/24
    https://seclists.org/bugtraq/2019/Aug/31
    https://seclists.org/bugtraq/2019/Aug/43
    https://seclists.org/bugtraq/2019/Sep/18
    https://security.netapp.com/advisory/ntap-20190823-0001/
    https://security.netapp.com/advisory/ntap-20190823-0004/
    https://security.netapp.com/advisory/ntap-20190823-0005/
    https://support.f5.com/csp/article/K01988340
    https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp%3Butm_medium=RSS
    https://usn.ubuntu.com/4308-1/
    https://www.debian.org/security/2019/dsa-4503
    https://www.debian.org/security/2019/dsa-4508
    https://www.debian.org/security/2019/dsa-4520
    https://www.debian.org/security/2020/dsa-4669
    https://www.synology.com/security/advisory/Synology_SA_19_33

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High