Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

7.5 CVSS

Vulnerability Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9514

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thanks to Jonathan Looney of Netflix for reporting this vulnerability.

References

More from apple

View All →

CVE-2022-37724

Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary...

Medium 6.1

CVE-2020-24721

An issue was discovered in the GAEN (aka Google/Apple Exposure...

Medium 5.7

CVE-2020-20095

iMessage (Messages app) iOS 12.4 and prior user interface does...

Medium 6.5

CVE-2019-9518

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

High 7.5

CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

High 7.5

Affected Vendor

apple

View all reports →

Affected Software

swiftnio, traffic server, debian linux, ubuntu linux, skynas, diskstation manager, vs960hd firmware, fedora, leap, developer tools, jboss core services, jboss enterprise application platform, openshift container platform, openshift service mesh, openstack, quay, single sign-on, software collections, enterprise linux, enterprise linux eus, enterprise linux server, enterprise linux workstation, graalvm, web gateway, cloud insights, trident, big-ip local traffic manager, node.js

Vulnerable Versions:

1.0.0, 6.0.0, 7.0.0, 8.0.0, 10.0, 9.0, 16.04, 18.04, 19.04, 6.2, 29, 30, 15.0, 15.1, 1.0, 7.2.0, 7.3.0, 3.9, 3.10, 3.11, 4.1, 4.2, 14, 3.0.0, 7.3, 8.0, 8.1, 7.0, 19.2.0, 7.7.2.0, 7.8.2.0, 8.1.0, 11.6.1, 12.1.0, 13.1.0, 14.0.0, 14.1.0, 15.0.0, 8.9.0, 10.0.0, 10.13.0, 12.0.0