CVE-2019-9513

HIGH severity · CVSS 7.5 · Uncontrolled resource consumption

7.5CVSS HIGH

Summary

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)7%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (3)

Nginx Node.js Red Hat Enterprise Linux

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.htmlAdvisory
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.htmlAdvisory
https://access.redhat.com/errata/RHSA-2019:2692Advisory
https://access.redhat.com/errata/RHSA-2019:2745Advisory