CVE-2019-9517

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation without Limits17 documents8 sources
Severity
7.5HIGH
EPSS
6.0%
top 9.35%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
20
Apache Http ServerMcafee WEB GatewayNodejs Node.js+17 more
Timeline
PublishedAug 13
Latest updateMay 24

Description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages17 packages

▶NVDapache/http_server2.4.20 — 2.4.40
▶NVDopensuse/leap15.0, 15.1+1

Also affects: Debian Linux 10.0, 9.0, Fedora 29, 30, Ubuntu Linux 16.04, 18.04, 19.04, Enterprise Linux 8.0

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-w6v5-q8c8-52xx: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service↗2022-05-24
▶
OSV
CVE-2019-9517: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service↗2019-08-13
▶
CVEList
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service↗2019-08-13
▶

📋Vendor Advisories

3
Ubuntu
Apache HTTP Server vulnerabilities↗2019-08-29
▶
Red Hat
HTTP/2: request for large response leads to denial of service↗2019-08-13
▶
Debian
CVE-2019-9517: apache2 - Some HTTP/2 implementations are vulnerable to unconstrained interal data bufferi...↗2019
▶

💬Community

10
Bugzilla
CVE-2019-9517 undertow: HTTP/2: request for large response leads to denial of service [fedora-all]↗2019-09-03
▶
Bugzilla
CVE-2019-9517 httpd: HTTP/2: request for large response leads to denial of service [fedora-all]↗2019-08-16
▶
Bugzilla
CVE-2019-9517 nginx: HTTP/2: request for large response leads to denial of service [fedora-all]↗2019-08-16
▶
Bugzilla
CVE-2019-9511 CVE-2019-9516 CVE-2019-9517 mod_http2: various flaws [fedora-all]↗2019-08-16
▶
Bugzilla
CVE-2019-9517 nodejs: HTTP/2: request for large response leads to denial of service [fedora-all]↗2019-08-16
▶