Skip to content
Fencer Intel
high 7.5

CVE-2019-9515 in the critical feed json

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service

published 7y ago modified 4mo ago also EUVD-2019-18887

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
87.3%
EPSS 87.3% chance of exploitation in 30 days, percentile 99.7%
public exploits
0
none known

Summary

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Patch / fix

  • mcafee web_gateway 7.7.2.24, 7.8.2.13, 8.2.0
  • f5 big-ip_local_traffic_manager 11.6.5.1, 12.1.5.1, 13.1.3.2, 14.0.1.1, 14.1.2.1, 15.0.1.1
  • nodejs node.js 8.16.1, 10.16.3, 12.8.1
  • h2o Debian 12 2.2.5+dfsg2-3
  • trafficserver Debian 12 8.0.5+ds-1

debian advisories DEBIAN-CVE-2019-9515

  • twisted Ubuntu 18.04 LTS 17.9.0-2ubuntu0.1
  • twisted Ubuntu 20.04 LTS 18.9.0-6ubuntu1
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2019-9515

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • npm RHEL 8 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda
  • nodejs RHEL 8 1:10.16.3-2.module+el8.0.0+4214+49953fda
  • nodejs-nodemon RHEL 8 1.18.3-1.module+el8+2632+6c5111ed
  • nodejs-packaging RHEL 8 17-3.module+el8+2873+aa7dfd9a
  • rh-sso7-keycloak red hat single sign on 7 4.8.15-1.Final_redhat_00001.1.el8sso
  • rh-sso7-keycloak-server red hat single sign on 7 4.8.15-1.Final_redhat_00001.1.el8sso
  • rh-sso7-keycloak red hat single sign on 7 4.8.15-1.Final_redhat_00001.1.el7sso
  • rh-sso7-keycloak-server red hat single sign on 7 4.8.15-1.Final_redhat_00001.1.el7sso

red hat advisories RHSA-2019:2925RHSA-2024:5856RHSA-2019:4042RHSA-2019:4041RHSA-2019:4040RHSA-2019:4020

  • nodejs12 SLE Module for Web and Scripting 12 12.13.0-1.3.1
  • nodejs8 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15 8.16.1-3.20.1
  • nodejs10 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15, SLE Module for Web and Scripting 12 10.16.3-1.12.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
  • mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1
  • firefox-cairo SLES 11 SP4-LTSS 1.15.10-2.13.4

suse advisories SUSE-SU-2019:14246-1SUSE-SU-2020:0059-1SUSE-SU-2019:2260-1SUSE-SU-2019:2259-1SUSE-SU-2019:2254-1

  • nodejs8 openSUSE Leap 15.1, openSUSE Leap 15.0 8.16.1-lp151.2.6.1
  • nodejs10 openSUSE Leap 15.1, openSUSE Leap 15.0 10.16.3-lp151.2.6.1

opensuse advisories openSUSE-SU-2019:2115-1openSUSE-SU-2019:2114-1

  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2023+d2377ea3
  • nodejs-nodemon AlmaLinux 8 1.18.3-1.module_el8.3.0+2047+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2224+b07ac28e
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.4.0+2521+c668cc9f
  • nodejs-packaging AlmaLinux 8 17-3.module_el8.3.0+2023+d2377ea3

almalinux advisories ALSA-2019:2925

  • nodejs-nodemon Rocky Linux 8 1.18.3-1.module+el8.3.0+101+f84c7154
  • nodejs-packaging Rocky Linux 8 17-3.module+el8.3.0+101+f84c7154

rocky linux advisories RLSA-2019:2925

  • h2o Alpine 3.19, Alpine 3.18, Alpine 3.17 +6 more 2.2.6-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 10.16.3-r0
  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.2.9-r0
  • py3-twisted Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 19.10.0-r0

alpine advisories ALPINE-CVE-2019-9515

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Is CVE-2019-9515 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-9515 updated cvss 7.5

HTTP/2: flood using SETTINGS frames results in unbounded memory growth

  • Red Hat AMQ Broker 7 jetty, netty netty
    affected: no fix available
  • Red Hat Ceph Storage 3 grafana
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 undertow undertow
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes grpc, netty netty, undertow undertow, rhoar-nodejs rhoar-nodejs
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 operator-registry-container/grpc, operator-lifecycle-manager-container/grpc, sriov-network-device-plugin-container/grpc
    affected: no fix available
  • Red Hat AMQ
    fixed: vendor fix RHSA-2020:0922
  • Red Hat AMQ 7.4.3
    fixed: vendor fix RHSA-2020:1445
  • Red Hat Data Grid 7.3.3
    fixed: vendor fix RHSA-2020:0727
show 21 more
  • Red Hat Decision Manager 7
    fixed: vendor fix RHSA-2020:3196
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 10.16.3-2.module+el8.0.0+4214+49953fda, nodejs-packaging 17-3.module+el8+2873+aa7dfd9a, nodejs-nodemon 1.18.3-1.module+el8+2632+6c5111ed, npm 6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda
    fixed: vendor fix RHSA-2019:2925
  • Red Hat Fuse 6.3
    fixed: vendor fix RHSA-2019:4352
  • Red Hat Fuse 7.5.0
    fixed: vendor fix RHSA-2019:3892
  • Red Hat Fuse 7.6.0
    fixed: vendor fix RHSA-2020:0983
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2019:4021
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-yasson 1.0.5-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.5-4.GA_redhat_00002.1.el6eap, eap7-apache-cxf 3.2.10-1.redhat_00001.1.el6eap, eap7-byte-buddy 1.9.11-1.redhat_00002.1.el6eap, eap7-resteasy 3.6.1-7.SP7_redhat_00001.1.el6eap, eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el6eap, +90 more
    fixed: vendor fix RHSA-2019:4018
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-yasson 1.0.5-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.5-4.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.2.10-1.redhat_00001.1.el7eap, eap7-byte-buddy 1.9.11-1.redhat_00002.1.el7eap, eap7-resteasy 3.6.1-7.SP7_redhat_00001.1.el7eap, eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el7eap, +92 more
    fixed: vendor fix RHSA-2019:4019
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-yasson 1.0.5-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.5-4.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.2.10-1.redhat_00001.1.el8eap, eap7-byte-buddy 1.9.11-1.redhat_00002.1.el8eap, eap7-resteasy 3.6.1-7.SP7_redhat_00001.1.el8eap, eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el8eap, +90 more
    fixed: vendor fix RHSA-2019:4020
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.7-2.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.45-1.Final_redhat_00001.1.ep7.el7, eap7-infinispan 8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-undertow 1.4.18-12.SP12_redhat_00001.1.ep7.el7, eap7-netty-all 4.1.45-1.Final_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.7-2.GA_redhat_00002.1.ep7.el7, +9 more
    fixed: vendor fix RHSA-2024:5856
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
    fixed: vendor fix RHSA-2020:2565
  • Red Hat OpenShift Container Platform 4.1 openshift4/ose-multus-cni v4.1.15-201909041605, openshift4/ose-operator-registry v4.1.15-201909041605, openshift4/ose-operator-lifecycle-manager v4.1.15-201909041605, openshift4/ose-sriov-network-device-plugin v4.1.18-201909201915
    fixed: vendor fix RHSA-2019:2766
  • Red Hat OpenStack Platform 14.0 skydive 0.20.5-2.el7ost, skydive-agent 0.20.5-2.el7ost, skydive-ansible 0.20.5-2.el7ost, skydive-selinux 0.20.5-2.el7ost, skydive-analyzer 0.20.5-2.el7ost
    fixed: vendor fix RHSA-2019:2796
  • Red Hat Process Automation 7
    fixed: vendor fix RHSA-2020:3197
  • Red Hat Single Sign-On 7.3
    fixed: vendor fix RHSA-2019:4045
  • Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak 4.8.15-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server 4.8.15-1.Final_redhat_00001.1.el6sso
    fixed: vendor fix RHSA-2019:4040
  • Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak 4.8.15-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server 4.8.15-1.Final_redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2019:4041
  • Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak 4.8.15-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server 4.8.15-1.Final_redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2019:4042
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-nodejs8 3.0-5.el7, rh-nodejs10 3.2-3.el7, rh-nodejs8-runtime 3.0-5.el7, rh-nodejs10-runtime 3.2-3.el7, rh-nodejs8-scldevel 3.0-5.el7, rh-nodejs10-scldevel 3.2-3.el7, +4 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-nodejs8 3.0-5.el7, rh-nodejs10 3.2-3.el7, rh-nodejs8-runtime 3.0-5.el7, rh-nodejs10-runtime 3.2-3.el7, rh-nodejs8-scldevel 3.0-5.el7, rh-nodejs10-scldevel 3.2-3.el7, +4 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-nodejs8 3.0-5.el7, rh-nodejs10 3.2-3.el7, rh-nodejs8-runtime 3.0-5.el7, rh-nodejs10-runtime 3.2-3.el7, rh-nodejs8-scldevel 3.0-5.el7, rh-nodejs10-scldevel 3.2-3.el7, +4 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-nodejs8 3.0-5.el7, rh-nodejs10 3.2-3.el7, rh-nodejs8-runtime 3.0-5.el7, rh-nodejs10-runtime 3.2-3.el7, rh-nodejs8-scldevel 3.0-5.el7, rh-nodejs10-scldevel 3.2-3.el7, +4 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-nodejs8 3.0-5.el7, rh-nodejs10 3.2-3.el7, rh-nodejs8-runtime 3.0-5.el7, rh-nodejs10-runtime 3.2-3.el7, rh-nodejs8-scldevel 3.0-5.el7, rh-nodejs10-scldevel 3.2-3.el7, +4 more
    fixed: vendor fix RHSA-2019:2939
  • Red Hat Text-Only RHOAR
    fixed: vendor fix RHSA-2020:2067
  • Red Hat CloudForms Management Engine 5 nginx, nginx-mod-mail, nginx-filesystem, nginx-mod-stream, nginx-all-modules, nginx-mod-http-perl, +3 more Red Hat OpenShift Service Mesh Tech Preview maistra Red Hat Ansible Tower 3 nginx Red Hat Enterprise Linux 8 nginx, nginx-mod-mail, nginx-filesystem, nginx-mod-stream, nginx-all-modules, nginx-mod-http-perl, +2 more Red Hat JBoss Data Grid 7 undertow undertow Red Hat JBoss Data Virtualization 6 netty netty
    +2 more products
    Red Hat JBoss Enterprise Application Platform 6 jbossweb jbossweb Red Hat OpenShift Container Platform 3.9 nodejs, atomic-openshift, atomic-openshift-pod, atomic-openshift-node, atomic-openshift-tests, atomic-openshift-master, +9 more
    not affected: vulnerable code not present

8 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

87.29% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.