CVE-2019-9515

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

HIGH

7.5

CVSS Score

Published: August 13, 2019 at 08:50 PM UTC

Updated: June 17, 2026 at 02:43 AM UTC

24 products affected across 12 vendorsDebian LinuxFedoraUbuntu Linux

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 87%

Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Traffic Server · Apache

95%

6.0.0 ≤ v ≤ 6.2.37.0.0 ≤ v ≤ 7.1.68.0.0 ≤ v ≤ 8.0.3

Swiftnio · Apple

95%

1.0.0 ≤ v ≤ 1.4.0

apple-macos (environment) · canonical-ubuntu-linux (environment)

Ubuntu Linux · Canonicalrubygems

95%

16.04 18.04 19.04

Debian Linux · Debiandrupal

95%

10.0 9.0

Big IP Local Traffic Manager · F5

95%

11.6.1 ≤ v < 11.6.5.112.1.0 ≤ v < 12.1.5.113.1.0 ≤ v < 13.1.3.214.0.0 ≤ v < 14.0.1.114.1.0 ≤ v < 14.1.2.115.0.0 ≤ v < 15.0.1.1

Affected range stops below 11.6.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.1.5.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 13.1.3.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.0.1.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 14.1.2.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 15.0.1.1, so it looks safe — our inference, not a vendor statement

Fedora · Fedora Projectrpm

95%

29 30

Web Gateway · McAfee

95%

7.7.2.0 ≤ v < 7.7.2.247.8.2.0 ≤ v < 7.8.2.138.1.0 ≤ v < 8.2.0

Affected range stops below 7.7.2.24, so it looks safe — our inference, not a vendor statement

Affected range stops below 7.8.2.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.2.0, so it looks safe — our inference, not a vendor statement

Node.js · Node.js

95%

10.0.0 ≤ v ≤ 10.12.010.13.0 ≤ v < 10.16.312.0.0 ≤ v < 12.8.18.0.0 ≤ v ≤ 8.8.18.9.0 ≤ v < 8.16.1

Affected range stops below 10.16.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 12.8.1, so it looks safe — our inference, not a vendor statement

Affected range stops below 8.16.1, so it looks safe — our inference, not a vendor statement

Leap · openSUSEdrupal

95%

15.0 15.1

GraalVM · Oracle

95%

19.2.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (38)

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

Vendor Advisoryx_refsource_SUSEMailing ListThird Party Advisory

Source: [email protected]

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

Mailing Listx_refsource_FULLDISCThird Party Advisory

Source: [email protected]

http://seclists.org/fulldisclosure/2019/Aug/16