CVE-2019-9511highCWE-400

CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size…

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

Published · Updated

Follow this CVE+ Monitor nodejs+ Monitor nodejs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 60%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
4 products (8 components)
Red Hat OpenShift Application Runtimes · Red Hat 3scale API Management Platform 2 · Red Hat AMQ Broker 7 · Red Hat JBoss Enterprise Web Server 3
workaround: Red Hat Quay 3.0 uses Nginx 1.12 from Red Hat Software Collections. It will be updated once a fixed is released for Software Collections. In the meantime users of Quay can disable http/2 support in Nginx by following these instructions: 1…
Fixed
27 products (1,600 components)
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) · Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) · Red Hat JBoss Core Services on RHEL 6 Server · and others 22
fix ↗
Not affected
15 products (98 components) — because the vulnerable code is not present in the product
Red Hat OpenShift Container Platform 3.9 · Red Hat OpenShift Container Platform 3.10 · Red Hat OpenShift Container Platform 3.11 · Red Hat Enterprise Linux 8 · CloudForms Management Engine 5 · and others 10
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
n/a · n/a