CVE-2019-9513
published 2019-08-13CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and…
PriorityP359high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
82.02%
99.6th percentile
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Affected
66 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | traffic_server | 6.0.0 – 6.2.3 | — |
| apache | traffic_server | 7.0.0 – 7.1.6 | — |
| apache | traffic_server | 8.0.0 – 8.0.3 | — |
| apple | swiftnio | 1.0.0 – 1.4.0 | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | nghttp2 | < nghttp2 1.39.2-1 (bookworm) | nghttp2 1.39.2-1 (bookworm) |
| debian | nginx | < nghttp2 1.39.2-1 (bookworm) | nghttp2 1.39.2-1 (bookworm) |
| debian | nodejs | < nghttp2 1.39.2-1 (bookworm) | nghttp2 1.39.2-1 (bookworm) |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | >= 0 < 1.14.2-3 | 1.14.2-3 |
| f5 | nginx | 1.17.0 – 1.17.2 | — |
| f5 | nginx | >= 1.9.5 < 1.16.1 | 1.16.1 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| mcafee | web_gateway | >= 7.7.2.0 < 7.7.2.24 | 7.7.2.24 |
| mcafee | web_gateway | >= 7.8.2.0 < 7.8.2.13 | 7.8.2.13 |
| mcafee | web_gateway | >= 8.1.0 < 8.2.0 | 8.2.0 |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1607 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attacker creates multiple HTTP/2 request streams and continually shuffles stream priorities to cause churn in the priority tree, consuming excess CPU — look for abnormal volumes of PRIORITY frame traffic from a single client. ↗
- →Attack vector is unauthenticated and delivered via specially crafted HTTP/2 packets — monitor for unauthenticated clients sending high-rate HTTP/2 PRIORITY frames. ↗
- →On Windows/IIS, monitor or alert on the registry key Http2MaxPrioritiesPerStream under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters being absent or set to an unlimited value, indicating the host is unprotected against PRIORITY frame flooding. ↗
- →On Windows/IIS, the registry key Http2MaxServerResetsPerMinute under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters controls reset-frame rate limiting; absence or zero value may indicate exposure. ↗
- ·On Windows IIS, the patch adds new HTTP/2 rate-limiting registry values but they are OFF by default — administrators must manually configure them under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters to be fully protected. ↗
- ·Workaround for IIS: disable HTTP/2 entirely by setting DWORD values EnableHttp2TIs and EnableHttp2Cleartext to 0 under HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters, then restart. ↗
- ·Red Hat notes there is no available mitigation for nghttp2 and nodejs packages — both require a package update; disabling HTTP/2 in nginx is the only interim workaround for nginx-based deployments. ↗
- ·For Red Hat Quay 3.0 (nginx 1.12), HTTP/2 can be disabled by removing 'http2' from the nginx.conf using sed, then remounting the config into the container. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
nghttp2 vulnerability
osv·2024-05-07·CVSS 7.5
CVE-2019-9511 [HIGH] nghttp2 vulnerability
nghttp2 vulnerability
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited
OSV
nghttp2 vulnerabilities
osv·2024-04-25·CVSS 7.5
CVE-2019-9511 [HIGH] nghttp2 vulnerabilities
nghttp2 vulnerabilities
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this
issue to cause nghttp2 to consume resources, leading to a d
GHSA
GHSA-3p35-64mh-v96v: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
ghsa_unreviewed·2022-05-24
CVE-2019-9513 [HIGH] CWE-400 GHSA-3p35-64mh-v96v: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
OSV
CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
osv·2019-08-13·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513: Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Ubuntu
nghttp2 vulnerability
vendor_ubuntu·2024-05-07·CVSS 7.5
CVE-2024-28182 [HIGH] nghttp2 vulnerability
Title: nghttp2 vulnerability
Summary: Several security issues were fixed in nghttp2.
USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the
corresponding update for Ubuntu 24.04 LTS.
Original advisory details:
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It w
Ubuntu
nghttp2 vulnerabilities
vendor_ubuntu·2024-04-25·CVSS 7.5
CVE-2024-28182 [HIGH] nghttp2 vulnerabilities
Title: nghttp2 vulnerabilities
Summary: Several security issues were fixed in nghttp2.
It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)
It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)
It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use
Ubuntu
nginx vulnerabilities
vendor_ubuntu·2019-08-15
CVE-2019-9511 nginx vulnerabilities
Title: nginx vulnerabilities
Summary: nginx could be made to crash if it received specially crafted network
traffic.
Jonathan Looney discovered that nginx incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to consume
resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
HTTP/2 Server Denial of Service Vulnerability
vendor_msrc·2019-08-13·CVSS 7.5
CVE-2019-9513 [HIGH] HTTP/2 Server Denial of Service Vulnerability
HTTP/2 Server Denial of Service Vulnerability
Description: A denial of service vulnerability exists in the HTTP/2 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP/2 requests. An attacker who successfully exploited the vulnerability could create a denial of service condition, causing the target system to become unresponsive.
To exploit this vulnerability, an unauthenticated attacker could send a specially crafted HTTP packet to a target system, causing the affected system to become nonresponsive.
The update addresses the vulnerability by modifying how the Windows HTTP protocol stack handles HTTP/2 requests. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate user rights.
FAQ: After I install the HTTP/2 upd
Red Hat
HTTP/2: flood using PRIORITY frames results in excessive resource consumption
vendor_redhat·2019-08-13·CVSS 7.5
CVE-2019-9513 [HIGH] CWE-400 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
HTTP/2: flood using PRIORITY frames results in excessive resource consumption
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
A flaw was found in HTTP/2. An attacker, using PRIORITY frames to flood the system, could cause excessive CPU usage and starvation of other clients. The largest threat from this vulnerability is to system availability.
Statement: This flaw has no available mitigation for packages nghttp2 and nodejs. Both packages will be updated once the available fixes are released for Red Hat Enterprise Linux and Red Hat Software Colle
Debian
CVE-2019-9513: nghttp2 - Some HTTP/2 implementations are vulnerable to resource loops, potentially leadin...
vendor_debian·2019·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513: nghttp2 - Some HTTP/2 implementations are vulnerable to resource loops, potentially leadin...
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Scope: local
bookworm: resolved (fixed in 1.39.2-1)
bullseye: resolved (fixed in 1.39.2-1)
forky: resolved (fixed in 1.39.2-1)
sid: resolved (fixed in 1.39.2-1)
trixie: resolved (fixed in 1.39.2-1)
No detection rules found.
No public exploits indexed.
HackerOne
Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
hackerone·2025-07-07·CVSS 7.5
[HIGH] Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations
Summary:
The HTTP/2 proxy implementation in curl contains potential integer overflow vulnerabilities in buffer size calculations that could lead to memory corruption or denial of service.
AI Usage Statement:
This report was prepared by a human security researcher after manual code review. No AI was used to generate this report.
Affected Version:
All curl versions containing the HTTP/2 proxy implementation (since introduction of the feature). Tested with curl 8.6.0 on Linux x86_64.
Examine the window size calculations in cf-h2-proxy.c:
#define PROXY_H2_CHUNK_SIZE (16*1024)
#define H2_TUNNEL_WINDOW_SIZE (10 * 1024 * 1024)
#define PROXY_H2_NW_RECV_CHUNKS (H2_TUNNEL_WINDOW_SIZE / PROXY_H2_CHUNK_SIZE)
The calculation H2_TUNNEL_
HackerOne
Nginx version is disclosed in HTTP response
hackerone·2020-02-06·CVSS 7.5
[HIGH] Nginx version is disclosed in HTTP response
Nginx version is disclosed in HTTP response
## Summary:
I found a version disclosure (Nginx) in your web server's HTTP response.
***Extracted Version:*** 1.16.1
This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Nginx.
## Steps To Reproduce:
***Checkout the URL:** https://localizestaging.com/
Checkout the header response:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Connection: close
Date: Sun, 26 Jan 2020 21:37:55 GMT
Server: nginx/1.16.1
Vary: Accept-Encoding
X-DNS-Prefetch-Control: off
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: object-src 'none'; base-uri https://localizestaging.com; frame-ancestors https://loc
Bugzilla
EPEL7 nginx package contains multiple CVEs
bugzilla·2019-09-10·CVSS 7.5
CVE-2019-9511 [HIGH] EPEL7 nginx package contains multiple CVEs
EPEL7 nginx package contains multiple CVEs
EPEL7 currently includes nginx 1.12.2, which is vulnerable to multiple CVS including CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 and which will not be patched upstream due to being EOL. Version 1.16.1 is packaged in current Fedora.
Version-Release number of selected component (if applicable):
nginx-1.12.2-3
How reproducible:
Always
Steps to Reproduce:
1. yum install nginx
Actual results:
nginx is version 1.12.2
Expected results:
nginx should be version 1.16.1
Discussion:
I haven't been involved here for many years but I noticed this ticket. As the old EPEL7 version is no longer patched upstream we may have no choice but to upgrade it to match Fedora. That is assuming nobody really has time to go through the effort of backporting the C
Bugzilla
CVE-2019-9513 undertow: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [fedora-all]
bugzilla·2019-09-03·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 undertow: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [fedora-all]
CVE-2019-9513 undertow: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issu
Bugzilla
CVE-2019-9513 nghttp2: http/2: HTTP/2 flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nghttp2: http/2: HTTP/2 flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
CVE-2019-9513 nghttp2: http/2: HTTP/2 flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: t
Bugzilla
CVE-2019-9513 nodejs: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nodejs: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
CVE-2019-9513 nodejs: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affe
Bugzilla
CVE-2019-9513 nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
CVE-2019-9513 nghttp2: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this iss
Bugzilla
CVE-2019-9513 nodejs: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nodejs: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
CVE-2019-9513 nodejs: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issu
Bugzilla
CVE-2019-9513 nghttp2: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nghttp2: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
CVE-2019-9513 nghttp2: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue aff
Bugzilla
CVE-2019-9513 nginx: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nginx: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
CVE-2019-9513 nginx: HTTP/2: flood using PRIORITY frames results in excessive resource consumption [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affec
Bugzilla
CVE-2019-9513 nginx: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
bugzilla·2019-08-16·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 nginx: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
CVE-2019-9513 nginx: HTTP/2: flood using PRIORITY frames resulting in excessive resource consumption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue
Bugzilla
CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
bugzilla·2019-08-01·CVSS 7.5
CVE-2019-9513 [HIGH] CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
HTTP/2 flood using PRIORITY frames that results in excessive CPU usage and starvation of other clients.
Discussion:
Acknowledgments:
Name: the Envoy security team
---
https://istio.io/blog/2019/announcing-1.2.4/
---
Created nghttp2 tracking bugs for this issue:
Affects: epel-all [bug 1741965]
Created nodejs tracking bugs for this issue:
Affects: epel-all [bug 1741971]
Affects: fedora-all [bug 1741967]
---
Created nghttp2 tracking bugs for this issue:
Affects: fedora-all [bug 1742011]
---
Created nginx tracking bugs for this issue:
Affects: epel-all [bug 1742296]
Affects: fedora-all [bug 1742294]
---
Upstream commit for NGINX: http://hg.nginx.org/nginx/rev/45415228990b
---
Exter
Tenable
Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
blogs_tenable·2019-08-14·CVSS 7.5
[HIGH] Multiple Denial of Service (DoS) Vulnerabilities in HTTP/2 Disclosed (CVE-2019-9511, CVE-2019-9518)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Talos
Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
blogs_talos·2019-08-13·CVSS 9.1
[CRITICAL] Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 97 vulnerabilities, 31 of which are rated “critical," 65 that are considered "important" and one "moderate."
This month’s security update covers security issues in a variety of Microsoft services and software, including certain graphics components, Outlook and the Chakra Scripting Engine. For more on our coverage of these bugs, check out our Snort advisories here, covering all of the new rules we have for this release.
### Critical vulnerabilities Microsoft disclosed 31 critical vulnerabilities this month, three of which we will highlight below.
CVE-2019-1181 and CVE-2019-1182 are both remote code execution vulnerabilities in Remote De
Talos
Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
blogs_talos·2019-08-13·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
## Microsoft Patch Tuesday — Aug. 2019: Vulnerability disclosures and Snort coverage
Microsoft released its monthly security update today, disclosing a variety of vulnerabilities in several of its products. The latest Patch Tuesday covers 97 vulnerabilities, 31 of which are rated “critical," 65 that are considered "important" and one "moderate."
This month’s security update covers security issues in a variety of Microsoft services and software, including certain graphics components, Outlook and the Chakra Scripting Engine. For more on our coverage of these bugs, check out our Snort advisories here , covering all of the new rules we have for this release.
## Critical vulnerabilities Microsoft disclosed 31 critical vulnerabilities this month, three of which we will highlight below.
CVE-2
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttps://access.redhat.com/errata/RHSA-2019:2692https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2949https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3041https://access.redhat.com/errata/RHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3935https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/https://seclists.org/bugtraq/2019/Aug/40https://seclists.org/bugtraq/2019/Sep/1https://security.netapp.com/advisory/ntap-20190823-0002/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K02591030https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4099-1/https://www.debian.org/security/2019/dsa-4505https://www.debian.org/security/2019/dsa-4511https://www.debian.org/security/2020/dsa-4669https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.synology.com/security/advisory/Synology_SA_19_33http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlhttps://access.redhat.com/errata/RHSA-2019:2692https://access.redhat.com/errata/RHSA-2019:2745https://access.redhat.com/errata/RHSA-2019:2746https://access.redhat.com/errata/RHSA-2019:2775https://access.redhat.com/errata/RHSA-2019:2799https://access.redhat.com/errata/RHSA-2019:2925https://access.redhat.com/errata/RHSA-2019:2939https://access.redhat.com/errata/RHSA-2019:2949https://access.redhat.com/errata/RHSA-2019:2955https://access.redhat.com/errata/RHSA-2019:2966https://access.redhat.com/errata/RHSA-2019:3041https://access.redhat.com/errata/RHSA-2019:3932https://access.redhat.com/errata/RHSA-2019:3933https://access.redhat.com/errata/RHSA-2019:3935https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdhttps://kb.cert.org/vuls/id/605641/https://kc.mcafee.com/corporate/index?page=content&id=SB10296https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/https://seclists.org/bugtraq/2019/Aug/40https://seclists.org/bugtraq/2019/Sep/1https://security.netapp.com/advisory/ntap-20190823-0002/https://security.netapp.com/advisory/ntap-20190823-0005/https://support.f5.com/csp/article/K02591030https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/4099-1/https://www.debian.org/security/2019/dsa-4505https://www.debian.org/security/2019/dsa-4511https://www.debian.org/security/2020/dsa-4669https://www.oracle.com/security-alerts/cpujan2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.synology.com/security/advisory/Synology_SA_19_33
2019-08-13
Published