CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

HIGH

7.5

CVSS Score

Published: August 13, 2019 at 12:00 AM UTC

Updated: June 17, 2026 at 02:43 AM UTC

30 products affected across 13 vendorsDebian LinuxFedoraUbuntu Linux

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 83%

Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Traffic Server · Apache

95%

6.0.0 ≤ v ≤ 6.2.37.0.0 ≤ v ≤ 7.1.68.0.0 ≤ v ≤ 8.0.3

Swiftnio · Apple

95%

1.0.0 ≤ v ≤ 1.4.0

apple-macos (environment) · canonical-ubuntu-linux (environment)

Ubuntu Linux · Canonicalrubygems

95%

16.04 18.04 19.04

Debian Linux · Debiandrupal

95%

10.0 9.0

Big IP Local Traffic Manager · F5

95%

11.6.1 ≤ v < 11.6.5.112.1.0 ≤ v < 12.1.5.113.1.0 ≤ v < 13.1.3.214.0.0 ≤ v < 14.0.1.114.1.0 ≤ v < 14.1.2.115.0.0 ≤ v < 15.0.1.1

Affected range stops below 11.6.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.1.3.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.0.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.1.2.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.0.1.1, so it looks safe — our inference, not a vendor statement

Fedora · Fedora Projectrpm

95%

29 30

Web Gateway · McAfee

95%

7.7.2.0 ≤ v < 7.7.2.247.8.2.0 ≤ v < 7.8.2.138.1.0 ≤ v < 8.2.0

Affected range stops below 7.7.2.24, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.8.2.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.2.0, so it looks safe — our inference, not a vendor statement

Cloud Insights · NetApp

95%

All versions

Trident · NetApp

95%

All versions

Node.js · Node.js

95%

10.0.0 ≤ v ≤ 10.12.010.13.0 ≤ v < 10.16.312.0.0 ≤ v < 12.8.18.0.0 ≤ v ≤ 8.8.18.9.0 ≤ v < 8.16.1

Affected range stops below 10.16.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.8.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.16.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references