Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service

7.5 CVSS

Vulnerability Description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9517

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Thanks to Jonathan Looney of Netflix for reporting this vulnerability.

References

More from apple

View All →

CVE-2022-37724

Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary...

Medium 6.1

CVE-2020-24721

An issue was discovered in the GAEN (aka Google/Apple Exposure...

Medium 5.7

CVE-2020-20095

iMessage (Messages app) iOS 12.4 and prior user interface does...

Medium 6.5

CVE-2019-9518

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service

High 7.5

CVE-2019-9516

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service

High 7.5

Affected Vendor

apple

View all reports →

Affected Software

swiftnio, http server, traffic server, ubuntu linux, debian linux, skynas, diskstation manager, vs960hd firmware, fedora, leap, jboss core services, jboss enterprise application platform, openshift service mesh, quay, software collections, enterprise linux, communications element manager, graalvm, instantis enterprisetrack, retail xstore point of service, web gateway, clustered data ontap, node.js

Vulnerable Versions:

1.0.0, 2.4.20, 6.0.0, 7.0.0, 8.0.0, 16.04, 18.04, 19.04, 9.0, 10.0, 6.2, 29, 30, 15.0, 15.1, 1.0, 7.2.0, 7.3.0, 3.0.0, 8.0, 8.1.0, 8.1.1, 8.2.0, 19.2.0, 17.1, 7.1, 7.7.2.0, 7.8.2.0, 8.9.0, 10.0.0, 10.13.0, 12.0.0