Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

7.5 CVSS

Vulnerability Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9515

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thanks to Jonathan Looney of Netflix for reporting this vulnerability.

References

More from apple

View All →

CVE-2022-37724

Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary...

Medium 6.1

CVE-2020-24721

An issue was discovered in the GAEN (aka Google/Apple Exposure...

Medium 5.7

CVE-2020-20095

iMessage (Messages app) iOS 12.4 and prior user interface does...

Medium 6.5

CVE-2019-9518

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

High 7.5

CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

High 7.5

Affected Vendor

apple

View all reports →

Affected Software

swiftnio, traffic server, ubuntu linux, debian linux, skynas, diskstation manager, vs960hd firmware, fedora, leap, jboss core services, jboss enterprise application platform, openshift container platform, openshift service mesh, openstack, quay, single sign-on, software collections, enterprise linux, graalvm, web gateway, big-ip local traffic manager, node.js

Vulnerable Versions:

1.0.0, 6.0.0, 7.0.0, 8.0.0, 16.04, 18.04, 19.04, 9.0, 10.0, 6.2, 29, 30, 15.0, 15.1, 1.0, 7.2.0, 7.3.0, 4.1, 14, 3.0.0, 7.3, 8.0, 19.2.0, 7.7.2.0, 7.8.2.0, 8.1.0, 11.6.1, 12.1.0, 13.1.0, 14.0.0, 14.1.0, 15.0.0, 8.9.0, 10.0.0, 10.13.0, 12.0.0