Tracker / CVE-2019-9514
CVE-2019-9514
High 7.5
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Affected products and versions
| apache | traffic_server · 6.0.0 → 6.2.3 |
|---|---|
| apache | traffic_server · 7.0.0 → 7.1.6 |
| apache | traffic_server · 8.0.0 → 8.0.3 |
| apple | swiftnio · 1.0.0 → 1.4.0 |
| canonical | ubuntu_linux |
| debian | debian_linux |
| f5 | big-ip_local_traffic_manager · 11.6.1 → 11.6.5.1 |
| f5 | big-ip_local_traffic_manager · 12.1.0 → 12.1.5.1 |
| f5 | big-ip_local_traffic_manager · 13.1.0 → 13.1.3.2 |
| f5 | big-ip_local_traffic_manager · 14.0.0 → 14.0.1.1 |
| f5 | big-ip_local_traffic_manager · 14.1.0 → 14.1.2.1 |
| f5 | big-ip_local_traffic_manager · 15.0.0 → 15.0.1.1 |
| fedoraproject | fedora |
| mcafee | web_gateway · 7.7.2.0 → 7.7.2.24 |
| mcafee | web_gateway · 7.8.2.0 → 7.8.2.13 |
| mcafee | web_gateway · 8.1.0 → 8.2.0 |
| netapp | cloud_insights |
| netapp | trident |
| nodejs | node.js · 10.0.0 → 10.12.0 |
| nodejs | node.js · 10.13.0 → 10.16.3 |
| nodejs | node.js · 12.0.0 → 12.8.1 |
| nodejs | node.js · 8.0.0 → 8.8.1 |
| nodejs | node.js · 8.9.0 → 8.16.1 |
| opensuse | leap |
| oracle | graalvm |
| redhat | developer_tools |
| redhat | enterprise_linux |
| redhat | enterprise_linux_eus |
| redhat | enterprise_linux_server |
| redhat | enterprise_linux_workstation |
| redhat | jboss_core_services |
| redhat | jboss_enterprise_application_platform |
| redhat | openshift_container_platform |
| redhat | openshift_service_mesh |
| redhat | openstack |
| redhat | quay |
| redhat | single_sign-on |
| redhat | software_collections |
| synology | diskstation_manager |
| synology | skynas |
| synology | vs960hd_firmware |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.