NetSight
IP …
high7.5

CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

Impact

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Affected products

VendorProductAffected versions
AppleSwiftnio
from 1.0.0 through 1.4.0
ApacheTraffic Server
from 6.0.0 through 6.2.3
from 7.0.0 through 7.1.6
from 8.0.0 through 8.0.3
DebianDebian Linux
Versions 10.0, 9.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
SynologySkynas
All versions
SynologyDiskstation Manager
Version 6.2
SynologyVs960hd Firmware
All versions
FedoraprojectFedora
Versions 29, 30
OpensuseLeap
Versions 15.0, 15.1
RedhatDeveloper Tools
Version 1.0
RedhatJboss Core Services
Version 1.0
RedhatJboss Enterprise Application Platform
Versions 7.2.0, 7.3.0

Weakness classification

CWE-400CWE-770

References