VulnerabilityModified
CVE-2019-9512
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service.
HIGH 7.5EPSS 83.4%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 83.4%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 83.43% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400
- Affected
- apple/swiftnio · apache/traffic server · debian/debian linux · nodejs/node.js
- Source
- cret@cert.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.htmlMailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Aug/16Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2019/08/20/1Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2594Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2661Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2682Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2690Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2726Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2766Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2769Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2796Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2861Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2966Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3131Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3245Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3265Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3892Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3906Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4018Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4019Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4020Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.