CVE-2019-9514
highpriority · attend · 59EPSS 0.828 · 100 %ileDEEURUUSEPSS · scored 2026-10-22
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (107)
Products and version ranges known to be affected.
advisories (7)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2022-0770IBM DB2: Mehrere SchwachstellenDeutsch2020-04-23csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen
- WID-SEC-W-2024-1926Red Hat JBoss Enterprise Application Platform: Mehrere SchwachstellenDeutsch2024-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform auf Red Hat Enterprise Linux ausnutzen, um beliebigen Programmcode auszuführen, einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen preiszugeben, Dateien und Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.
- WID-SEC-W-2026-0426Apache Traffic Server: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2019-08-14csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache Traffic Server ausnutzen, um einen Denial of Service Angriff durchzuführen.
- GHSA-39qc-96h7-956fgolang.org/x/net/http vulnerable to a reset flood2022-05-24ghsa · osvUS
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2
- GHSA-hgr8-6h9x-f7q9golang.org/x/net/http vulnerable to ping floods2022-05-24ghsa · osvUS
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. ### Specific Go Packages Affected golang.org/x/net/http2
- CVE-2019-95122019-08-13vendor · osvUS
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
- GO-2022-0536Reset flood in net/http and golang.org/x/net/http2022-08-01vendor · osvUS
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (304)
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlcnnvd
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.htmlcnnvd
- http://seclists.org/fulldisclosure/2019/Aug/16cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan