cbcvebase.
CVE-2019-9511
published 2019-08-13

CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The…

PriorityP357high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
58.37%
99.0th percentile
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected

90 ranges· showing 25
VendorProductVersion rangeFixed in
apachetraffic_server6.0.0 – 6.2.3
apachetraffic_server7.0.0 – 7.1.6
apachetraffic_server8.0.0 – 8.0.3
appleswiftnio1.0.0 – 1.4.0
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debiannghttp2< nghttp2 1.39.2-1 (bookworm)nghttp2 1.39.2-1 (bookworm)
debiannginx< nghttp2 1.39.2-1 (bookworm)nghttp2 1.39.2-1 (bookworm)
debiannodejs< nghttp2 1.39.2-1 (bookworm)nghttp2 1.39.2-1 (bookworm)
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx1.17.0 – 1.17.2
f5nginx>= 1.9.5 < 1.16.11.16.1
fedoraprojectfedora
fedoraprojectfedora
mcafeeactive_response
mcafeeactive_response
mcafeeactive_response
mcafeeactive_response
mcafeeactive_response

Detection & IOCsextracted from sources · hover to see the quote

registryHKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters
  • Attacker manipulates HTTP/2 window size and stream priority to force server to queue data in 1-byte chunks, causing CPU/memory exhaustion — detect abnormally small HTTP/2 WINDOW_UPDATE frames combined with high-priority stream requests consuming disproportionate server resources.
  • Monitor for HTTP/2 connections sending excessive WINDOW_UPDATE frames per stream — the Windows HTTP.sys mitigation registry key Http2MaxWindowUpdatesPerSend can be used as a detection threshold reference.
  • Monitor for HTTP/2 connections sending excessive PRIORITY frames per stream — the Windows HTTP.sys mitigation registry key Http2MaxPrioritiesPerStream can be used as a detection threshold reference.
  • Alert on HTTP/2 clients sending unusually high numbers of RST_STREAM frames per minute, consistent with stream prioritization abuse.
  • For nginx deployments, detect exploitation attempts by monitoring for sudden CPU/memory spikes correlated with HTTP/2 traffic; consider disabling HTTP/2 as a mitigation by removing 'http2' from nginx.conf listen directives.
  • ·On Windows IIS/HTTP.sys, HTTP/2 rate-limiting registry keys (Http2MaxWindowUpdatesPerSend, Http2MaxPrioritiesPerStream, Http2MaxResetsPerStream, Http2MaxServerResetsPerMinute, Http2MinimumSendWindowSize) are added by the patch but are OFF by default — administrators must explicitly configure them to be protected.
  • ·Registry keys EnableHttp2TIs and EnableHttp2Cleartext set to 0 fully disable HTTP/2 on Windows as a workaround, but require a system restart to take effect.
  • ·There are no mitigations available for nghttp2 and nodejs on Red Hat platforms; patching is the only remediation path.
  • ·The nodejs RPM shipped in OpenShift Container Platform 3.9 and 3.10 is explicitly not affected as it does not contain the vulnerable code.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.