Vulnerability Description
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Swiftnio | >= 1.0.0, <= 1.4.0 |
| Apple | Mac Os X | >= 10.12 |
| Canonical | Ubuntu Linux | >= 14.04 |
| Apache | Traffic Server | >= 6.0.0, <= 6.2.3 |
| Debian | Debian Linux | 9.0 |
| Synology | Skynas | - |
| Synology | Diskstation Manager | 6.2 |
| Synology | Vs960Hd Firmware | - |
| Synology | Vs960Hd | - |
| Fedoraproject | Fedora | 29 |
| Opensuse | Leap | 15.0 |
| Redhat | Jboss Core Services | 1.0 |
| Redhat | Jboss Enterprise Application Platform | 7.2.0 |
| Redhat | Openshift Service Mesh | 1.0 |
| Redhat | Quay | 3.0.0 |
| Redhat | Software Collections | 1.0 |
| Redhat | Enterprise Linux | 8.0 |
| Oracle | Graalvm | 19.2.0 |
| Mcafee | Web Gateway | >= 7.7.2.0, < 7.7.2.24 |
| Nodejs | Node.Js | >= 8.0.0, <= 8.8.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlMailing ListThird Party Advisory
- http://seclists.org/fulldisclosure/2019/Aug/16Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2925Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2939Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2955Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3892Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:4352Third Party Advisory
- https://access.redhat.com/errata/RHSA-2020:0727Third Party Advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-partyThird Party Advisory
- https://kb.cert.org/vuls/id/605641/Third Party AdvisoryUS Government Resource
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296Third Party Advisory
- https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e
- https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b667
FAQ
What is CVE-2019-9518?
CVE-2019-9518 is a vulnerability with a CVSS score of 7.5 (HIGH). Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-st...
How severe is CVE-2019-9518?
CVE-2019-9518 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-9518?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Swiftnio, Apple Mac Os X, Canonical Ubuntu Linux, Apache Traffic Server, Debian Debian Linux.