CVE-2019-9514 vulnerability in Apache and Other Products
Published on August 13, 2019

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Github Repository Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2019-9514 has been classified to as a Resource Exhaustion vulnerability or weakness.

Products Associated with CVE-2019-9514

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2019-9514 are published in these products:

Apache Traffic Server

Debian Linux

Canonical Ubuntu Linux

Synology Skynas

Synology Diskstation Manager

Fedora Project Fedora

OpenSuse Leap

Red Hat Enterprise Linux Workstation

Red Hat Enterprise Linux Server

Red Hat Software Collections

Red Hat Openshift Container Platform

Red Hat Jboss Core Services

Red Hat Enterprise Linux (RHEL)

Red Hat Jboss Enterprise Application Platform

Red Hat Single Sign On

Red Hat Developer Tools

Red Hat Quay

Red Hat Enterprise Linux Eus

Red Hat Openshift Service Mesh

Red Hat Openstack

Oracle GraalVM

McAfee Web Gateway

NetApp Cloud Insights

NetApp Trident

F5 Networks Big Ip Local Traffic Manager

nodejs node.js

Vulnerable Packages

The following package name and versions may be associated with CVE-2019-9514

Package Manager	Vulnerable Package	Versions	Fixed In
pip	twisted	< 19.10.0	19.10.0

Exploit Probability

EPSS

9.48%

Percentile

92.71%