CVE-2019-9512
high · 7.5Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
7.5
CVSS
83.4%
EPSS (exploit prob.)
100th
EPSS percentile
2019-08-13
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| apple | swiftnio | >= 1.0.0, <= 1.4.0 |
| apple | mac_os_x | >= 10.12 |
| canonical | ubuntu_linux | >= 14.04 |
| apache | traffic_server | >= 6.0.0, <= 6.2.3 |
| apache | traffic_server | >= 7.0.0, <= 7.1.6 |
| apache | traffic_server | >= 8.0.0, <= 8.0.3 |
| debian | debian_linux | 10.0 |
| nodejs | node.js | >= 8.0.0, <= 8.8.1 |
| nodejs | node.js | >= 8.9.0, < 8.16.1 |
| nodejs | node.js | >= 10.0.0, <= 10.12.0 |
| nodejs | node.js | >= 10.13.0, < 10.16.3 |
| nodejs | node.js | >= 12.0.0, < 12.8.1 |
Check a specific version with /api/v1/cve/match.
References
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
- http://seclists.org/fulldisclosure/2019/Aug/16
- http://www.openwall.com/lists/oss-security/2019/08/20/1
- https://access.redhat.com/errata/RHSA-2019:2594
- https://access.redhat.com/errata/RHSA-2019:2661
- https://access.redhat.com/errata/RHSA-2019:2682
- https://access.redhat.com/errata/RHSA-2019:2690
- https://access.redhat.com/errata/RHSA-2019:2726
- https://access.redhat.com/errata/RHSA-2019:2766
- https://access.redhat.com/errata/RHSA-2019:2769
- https://access.redhat.com/errata/RHSA-2019:2796
- https://access.redhat.com/errata/RHSA-2019:2861
- https://access.redhat.com/errata/RHSA-2019:2925
- https://access.redhat.com/errata/RHSA-2019:2939
- https://access.redhat.com/errata/RHSA-2019:2955
- https://access.redhat.com/errata/RHSA-2019:2966
- https://access.redhat.com/errata/RHSA-2019:3131
- https://access.redhat.com/errata/RHSA-2019:3245
- https://access.redhat.com/errata/RHSA-2019:3265
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2019-9512