cbcvebase.
CVE-2019-9513
published 2019-08-13

CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and…

PriorityP359high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
82.02%
99.6th percentile
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Affected

66 ranges· showing 25
VendorProductVersion rangeFixed in
apachetraffic_server6.0.0 – 6.2.3
apachetraffic_server7.0.0 – 7.1.6
apachetraffic_server8.0.0 – 8.0.3
appleswiftnio1.0.0 – 1.4.0
canonicalubuntu_linux
canonicalubuntu_linux
canonicalubuntu_linux
debiandebian_linux
debiandebian_linux
debiannghttp2< nghttp2 1.39.2-1 (bookworm)nghttp2 1.39.2-1 (bookworm)
debiannginx< nghttp2 1.39.2-1 (bookworm)nghttp2 1.39.2-1 (bookworm)
debiannodejs< nghttp2 1.39.2-1 (bookworm)nghttp2 1.39.2-1 (bookworm)
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx>= 0 < 1.14.2-31.14.2-3
f5nginx1.17.0 – 1.17.2
f5nginx>= 1.9.5 < 1.16.11.16.1
fedoraprojectfedora
fedoraprojectfedora
mcafeeweb_gateway>= 7.7.2.0 < 7.7.2.247.7.2.24
mcafeeweb_gateway>= 7.8.2.0 < 7.8.2.137.8.2.13
mcafeeweb_gateway>= 8.1.0 < 8.2.08.2.0
msrcwindows_10
msrcwindows_10_version_1607

Detection & IOCsextracted from sources · hover to see the quote

  • Attacker creates multiple HTTP/2 request streams and continually shuffles stream priorities to cause churn in the priority tree, consuming excess CPU — look for abnormal volumes of PRIORITY frame traffic from a single client.
  • Attack vector is unauthenticated and delivered via specially crafted HTTP/2 packets — monitor for unauthenticated clients sending high-rate HTTP/2 PRIORITY frames.
  • On Windows/IIS, monitor or alert on the registry key Http2MaxPrioritiesPerStream under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters being absent or set to an unlimited value, indicating the host is unprotected against PRIORITY frame flooding.
  • On Windows/IIS, the registry key Http2MaxServerResetsPerMinute under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters controls reset-frame rate limiting; absence or zero value may indicate exposure.
  • ·On Windows IIS, the patch adds new HTTP/2 rate-limiting registry values but they are OFF by default — administrators must manually configure them under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters to be fully protected.
  • ·Workaround for IIS: disable HTTP/2 entirely by setting DWORD values EnableHttp2TIs and EnableHttp2Cleartext to 0 under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters, then restart.
  • ·Red Hat notes there is no available mitigation for nghttp2 and nodejs packages — both require a package update; disabling HTTP/2 in nginx is the only interim workaround for nginx-based deployments.
  • ·For Red Hat Quay 3.0 (nginx 1.12), HTTP/2 can be disabled by removing 'http2' from the nginx.conf using sed, then remounting the config into the container.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.