Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

7.5 CVSS

Vulnerability Description

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9516

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thanks to Jonathan Looney of Netflix for reporting this vulnerability.

References

More from apple

View All →

CVE-2022-37724

Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary...

Medium 6.1

CVE-2020-24721

An issue was discovered in the GAEN (aka Google/Apple Exposure...

Medium 5.7

CVE-2020-20095

iMessage (Messages app) iOS 12.4 and prior user interface does...

Medium 6.5

CVE-2019-9518

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

High 7.5

CVE-2019-9517

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

High 7.5

Affected Vendor

apple

View all reports →

Affected Software

swiftnio, traffic server, ubuntu linux, debian linux, fedora, skynas, diskstation manager, vs960hd firmware, leap, jboss core services, jboss enterprise application platform, openshift service mesh, quay, software collections, enterprise linux, graalvm, web gateway, nginx, node.js

Vulnerable Versions:

1.0.0, 6.0.0, 7.0.0, 8.0.0, 16.04, 18.04, 19.04, 9.0, 10.0, 30, 29, 32, 6.2, 15.0, 15.1, 1.0, 7.2.0, 7.3.0, 3.0.0, 8.0, 19.2.0, 7.7.2.0, 7.8.2.0, 8.1.0, 1.9.5, 1.17.0, 10.0.0, 12.0.0