VulnerabilityModified
CVE-2019-9516
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
MEDIUM 6.5EPSS 56.3%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 56.3%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 56.26% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-400, CWE-770
- Affected
- apple/swiftnio · apache/traffic server · canonical/ubuntu linux · debian/debian linux · fedoraproject/fedora · synology/skynas · synology/diskstation manager · synology/vs960hd firmware · opensuse/leap · redhat/jboss core services · redhat/jboss enterprise application platform · redhat/openshift service mesh · redhat/quay · redhat/software collections · redhat/enterprise linux · oracle/graalvm · mcafee/web gateway · f5/nginx · nodejs/node.js
- Source
- cret@cert.org
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlMailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2019/Aug/16Mailing List, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2745Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2746Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2775Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2799Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2946Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2950Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2966Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3932Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3933Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3935Third Party Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdThird Party Advisory
- https://kb.cert.org/vuls/id/605641/Third Party Advisory, US Government Resource
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/
- https://seclists.org/bugtraq/2019/Aug/24Mailing List, Third Party Advisory
- https://seclists.org/bugtraq/2019/Aug/40Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.