CVE-2019-9511
published 2019-08-13CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The…
PriorityP357high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
58.37%
99.0th percentile
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Affected
90 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | 6.0.0 – 6.2.3 | — |
| apache | traffic_server | 7.0.0 – 7.1.6 | — |
| apache | traffic_server | 8.0.0 – 8.0.3 | — |
| apple | swiftnio | 1.0.0 – 1.4.0 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | nghttp2 | < nghttp2 1.39.2-1 (bookworm) | nghttp2 1.39.2-1 (bookworm) |
| debian | nginx | < nghttp2 1.39.2-1 (bookworm) | nghttp2 1.39.2-1 (bookworm) |
| debian | nodejs | < nghttp2 1.39.2-1 (bookworm) | nghttp2 1.39.2-1 (bookworm) |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | 1.17.0 – 1.17.2 | — |
| f5 | nginx | >= 1.9.5 < 1.16.1 | 1.16.1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mcafee | active_response | — | — |
| mcafee | active_response | — | — |
| mcafee | active_response | — | — |
| mcafee | active_response | — | — |
| mcafee | active_response | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker manipulates HTTP/2 window size and stream priority to force server to queue data in 1-byte chunks, causing CPU/memory exhaustion — detect abnormally small HTTP/2 WINDOW_UPDATE frames combined with high-priority stream requests consuming disproportionate server resources. ↗
- →Monitor for HTTP/2 connections sending excessive WINDOW_UPDATE frames per stream — the Windows HTTP.sys mitigation registry key Http2MaxWindowUpdatesPerSend can be used as a detection threshold reference. ↗
- →Monitor for HTTP/2 connections sending excessive PRIORITY frames per stream — the Windows HTTP.sys mitigation registry key Http2MaxPrioritiesPerStream can be used as a detection threshold reference. ↗
- →Alert on HTTP/2 clients sending unusually high numbers of RST_STREAM frames per minute, consistent with stream prioritization abuse. ↗
- →For nginx deployments, detect exploitation attempts by monitoring for sudden CPU/memory spikes correlated with HTTP/2 traffic; consider disabling HTTP/2 as a mitigation by removing 'http2' from nginx.conf listen directives. ↗
- ·On Windows IIS/HTTP.sys, HTTP/2 rate-limiting registry keys (Http2MaxWindowUpdatesPerSend, Http2MaxPrioritiesPerStream, Http2MaxResetsPerStream, Http2MaxServerResetsPerMinute, Http2MinimumSendWindowSize) are added by the patch but are OFF by default — administrators must explicitly configure them to be protected. ↗
- ·Registry keys EnableHttp2TIs and EnableHttp2Cleartext set to 0 fully disable HTTP/2 on Windows as a workaround, but require a system restart to take effect. ↗
- ·There are no mitigations available for nghttp2 and nodejs on Red Hat platforms; patching is the only remediation path. ↗
- ·The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is explicitly not affected as it does not contain the vulnerable code. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nghttp2 vulnerability
osv·2024-05-07·CVSS 7.5
CVE-2019-9511 [HIGH] nghttp2 vulnerability
nghttp2 vulnerability
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited
OSV
nghttp2 vulnerabilities
osv·2024-04-25·CVSS 7.5
CVE-2019-9511 [HIGH] nghttp2 vulnerabilities
nghttp2 vulnerabilities
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this
issue to cause nghttp2 to consume resources, leading to a d
GHSA
GHSA-89fc-749h-w2fj: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serv
ghsa_unreviewed·2022-05-24
CVE-2019-9511 [HIGH] CWE-400 GHSA-89fc-749h-w2fj: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serv
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
GHSA
GHSA-jjmf-77v6-6356: McAfee Web Gateway (MWG) earlier than 7
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2019-3643 [HIGH] CWE-20 GHSA-jjmf-77v6-6356: McAfee Web Gateway (MWG) earlier than 7
McAfee Web Gateway (MWG) earlier than 7.8.2.13 is vulnerable to a remote attacker exploiting CVE-2019-9511, potentially leading to a denial of service. This affects the scanning proxies.
OSV
CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serv
osv·2019-08-13·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of serv
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Ubuntu
nghttp2 vulnerability
vendor_ubuntu·2024-05-07·CVSS 7.5
CVE-2024-28182 [HIGH] nghttp2 vulnerability
Title: nghttp2 vulnerability
Summary: Several security issues were fixed in nghttp2.
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It w
Ubuntu
nghttp2 vulnerabilities
vendor_ubuntu·2024-04-25·CVSS 7.5
CVE-2024-28182 [HIGH] nghttp2 vulnerabilities
Title: nghttp2 vulnerabilities
Summary: Several security issues were fixed in nghttp2.
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2019-08-15
CVE-2019-9511 nginx vulnerabilities
Title: nginx vulnerabilities
Summary: nginx could be made to crash if it received specially crafted network
traffic.
Jonathan Looney discovered that nginx incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
HTTP/2: large amount of data requests leads to denial of service
vendor_redhat·2019-08-13·CVSS 7.5
CVE-2019-9511 [HIGH] CWE-400 HTTP/2: large amount of data requests leads to denial of service
HTTP/2: large amount of data requests leads to denial of service
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
A flaw was found in HTTP/2. An attacker can request a large amount of data by manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this queue can consume excess CPU, memory, or both, lea
Microsoft
HTTP/2 Server Denial of Service Vulnerability
vendor_msrc·2019-08-13·CVSS 7.5
CVE-2019-9511 [HIGH] HTTP/2 Server Denial of Service Vulnerability
HTTP/2 Server Denial of Service Vulnerability
Description: A denial of service vulnerability exists in the HTTP/2 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP/2 requests. An attacker who successfully exploited the vulnerability could create a denial of service condition, causing the target system to become unresponsive.
To exploit this vulnerability, an unauthenticated attacker could send a specially crafted HTTP packet to a target system, causing the affected system to become nonresponsive.
The update addresses the vulnerability by modifying how the Windows HTTP protocol stack handles HTTP/2 requests. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate user rights.
FAQ: After I install the HTTP/2 upd
Debian
CVE-2019-9511: nghttp2 - Some HTTP/2 implementations are vulnerable to window size manipulation and strea...
vendor_debian·2019·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511: nghttp2 - Some HTTP/2 implementations are vulnerable to window size manipulation and strea...
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Scope: local
bookworm: resolved (fixed in 1.39.2-1)
bullseye: resolved (fixed in 1.39.2-1)
forky: resolved (fixed in 1.39.2-1)
sid: resolved (fixed in 1.39.2-1)
trixie: resolved (fixed in 1.39.2-1)
No detection rules found.
No public exploits indexed.
HackerOne
Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
hackerone·2025-07-07·CVSS 7.5
[HIGH] Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Summary:
The HTTP/2 proxy implementation in curl contains potential integer overflow vulnerabilities in buffer size calculations that could lead to memory corruption or denial of service.
AI Usage Statement:
This report was prepared by a human security researcher after manual code review. No AI was used to generate this report.
Affected Version:
All curl versions containing the HTTP/2 proxy implementation (since introduction of the feature). Tested with curl 8.6.0 on Linux x86_64.
Examine the window size calculations in cf-h2-proxy.c:
#define PROXY_H2_CHUNK_SIZE (16*1024)
#define H2_TUNNEL_WINDOW_SIZE (10 * 1024 * 1024)
#define PROXY_H2_NW_RECV_CHUNKS (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
The calculation H2_TUNNEL_
HackerOne
Nginx version is disclosed in HTTP response
hackerone·2020-02-06·CVSS 7.5
[HIGH] Nginx version is disclosed in HTTP response
Nginx version is disclosed in HTTP response
## Summary:
I found a version disclosure (Nginx) in your web server's HTTP response.
***Extracted Version:*** 1.16.1
This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx.
## Steps To Reproduce:
***Checkout the URL:** https://localizestaging.com/
Checkout the header response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sun, 26 Jan 2020 21:37:55 GMT
Server: nginx/1.16.1
Vary: Accept-Encoding
X-DNS-Prefetch-Control: off
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: object-src 'none'; base-uri https://localizestaging.com; frame-ancestors https://loc
Bugzilla
EPEL7 nginx package contains multiple CVEs
bugzilla·2019-09-10·CVSS 7.5
CVE-2019-9511 [HIGH] EPEL7 nginx package contains multiple CVEs
EPEL7 nginx package contains multiple CVEs
EPEL7 currently includes nginx 1.12.2, which is vulnerable to multiple CVS including CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 and which will not be patched upstream due to being EOL. Version 1.16.1 is packaged in current Fedora.
Version-Release number of selected component (if applicable):
nginx-1.12.2-3
How reproducible:
Always
Steps to Reproduce:
1. yum install nginx
Actual results:
nginx is version 1.12.2
Expected results:
nginx should be version 1.16.1
Discussion:
I haven't been involved here for many years but I noticed this ticket. As the old EPEL7 version is no longer patched upstream we may have no choice but to upgrade it to match Fedora. That is assuming nobody really has time to go through the effort of backporting the C
Bugzilla
CVE-2019-9511 undertow: HTTP/2: large amount of data requests leads to denial of service [fedora-all]
bugzilla·2019-09-03·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 undertow: HTTP/2: large amount of data requests leads to denial of service [fedora-all]
CVE-2019-9511 undertow: HTTP/2: large amount of data requests leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects mul
Bugzilla
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [epel-all]
bugzilla·2019-08-22·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [epel-all]
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [fedora-all]
bugzilla·2019-08-22·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [fedora-all]
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2019-9511 nodejs: HTTP/2: large amount of data request leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nodejs: HTTP/2: large amount of data request leads to denial of service [fedora-all]
CVE-2019-9511 nodejs: HTTP/2: large amount of data request leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multip
Bugzilla
CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service
CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service
A vulnerability was found in http/2 where an attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both, potentially leading to a denial of service.
Discussion:
Created httpd tracking bugs for this issue:
Affects: fedora-all [bug 1741861]
---
Created mod_http2 tracking bugs for this issue:
Affects: fedora-all [bug 1741948]
Created nghttp2 tracking bugs for this issue:
Affects: fedora-all [bug 1741947]
---
Created nghttp2 tracking bugs for this issue:
Affects: epel-all [bug
Bugzilla
CVE-2019-9511 nginx: HTTP/2: large amount of data requests leads to denial of service [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nginx: HTTP/2: large amount of data requests leads to denial of service [epel-all]
CVE-2019-9511 nginx: HTTP/2: large amount of data requests leads to denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]
CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versio
Bugzilla
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [epel-all]
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [fedora-all]
CVE-2019-9511 nghttp2: HTTP/2: large amount of data request leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multi
Bugzilla
CVE-2019-9511 httpd: HTTP/2: large amount of data request leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 httpd: HTTP/2: large amount of data request leads to denial of service [fedora-all]
CVE-2019-9511 httpd: HTTP/2: large amount of data request leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
Bugzilla
CVE-2019-9511 nginx: HTTP/2: large amount of data request leads to denial of service [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nginx: HTTP/2: large amount of data request leads to denial of service [fedora-all]
CVE-2019-9511 nginx: HTTP/2: large amount of data request leads to denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multipl
Bugzilla
CVE-2019-9511 nodejs: HTTP/2: large amount of data requests leads to denial of service [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9511 [HIGH] CVE-2019-9511 nodejs: HTTP/2: large amount of data requests leads to denial of service [epel-all]
CVE-2019-9511 nodejs: HTTP/2: large amount of data requests leads to denial of service [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
HTTP/2 flood using PRIORITY frames that results in excessive CPU usage and starvation of other clients.
Discussion:
Acknowledgments:
Name: the Envoy security team
---
https://istio.io/blog/2019/announcing-1.2.4/
---
Created nghttp2 tracking bugs for this issue:
Affects: epel-all [bug 1741965]
Created nodejs tracking bugs for this issue:
Affects: epel-all [bug 1741971]
Affects: fedora-all [bug 1741967]
---
Created nghttp2 tracking bugs for this issue:
Affects: fedora-all [bug 1742011]
---
Created nginx tracking bugs for this issue:
Affects: epel-all [bug 1742296]
Affects: fedora-all [bug 1742294]
---
Upstream commit for NGINX: http://hg.nginx.org/nginx/rev/45415228990b
---
Exter
Tenable
Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
blogs_tenable·2019-08-14·CVSS 7.5
[HIGH] Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
blogs_talos·2019-08-13·CVSS 9.1
[CRITICAL] Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 97 vulnerabilities, 31 of which are rated “critical," 65 that are considered "important" and one "moderate."
This month’s security update covers security issues in a variety of Microsoft services and software, including certain graphics components, Outlook and the Chakra Scripting Engine. For more on our coverage of these bugs, check out our Snort advisories here, covering all of the new rules we have for this release.
### Critical vulnerabilities Microsoft disclosed 31 critical vulnerabilities this month, three of which we will highlight below.
CVE-2019-1181 and CVE-2019-1182 are both remote code execution vulnerabilities in Remote De
Talos
Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
blogs_talos·2019-08-13·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
## Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 97 vulnerabilities, 31 of which are rated “critical," 65 that are considered "important" and one "moderate."
This month’s security update covers security issues in a variety of Microsoft services and software, including certain graphics components, Outlook and the Chakra Scripting Engine. For more on our coverage of these bugs, check out our Snort advisories here , covering all of the new rules we have for this release.
## Critical vulnerabilities Microsoft disclosed 31 critical vulnerabilities this month, three of which we will highlight below.
CVE-2
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttps://access.redhat.com/errata/RHSA-2019:2692https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2949https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3041https://access.redhat.com/errata/RHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3935https://access.redhat.com/errata/RHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4021https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/https://seclists.org/bugtraq/2019/Aug/40https://seclists.org/bugtraq/2019/Sep/1https://security.netapp.com/advisory/ntap-20190823-0002/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K02591030https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4099-1/https://www.debian.org/security/2019/dsa-4505https://www.debian.org/security/2019/dsa-4511https://www.debian.org/security/2020/dsa-4669https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://www.synology.com/security/advisory/Synology_SA_19_33http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttps://access.redhat.com/errata/RHSA-2019:2692https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2949https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3041https://access.redhat.com/errata/RHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3935https://access.redhat.com/errata/RHSA-2019:4018https://access.redhat.com/errata/RHSA-2019:4019https://access.redhat.com/errata/RHSA-2019:4020https://access.redhat.com/errata/RHSA-2019:4021https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/https://seclists.org/bugtraq/2019/Aug/40https://seclists.org/bugtraq/2019/Sep/1https://security.netapp.com/advisory/ntap-20190823-0002/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K02591030https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4099-1/https://www.debian.org/security/2019/dsa-4505https://www.debian.org/security/2019/dsa-4511https://www.debian.org/security/2020/dsa-4669https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttps://www.synology.com/security/advisory/Synology_SA_19_33
2019-08-13
Published