CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
Published Aug 1, 2019
·Updated
A flaw was found in HTTP/2. Using HEADER frames with invalid HTTP headers and queuing of response RSTSTREAM frames, an attacker could cause a flood resulting in unbounded memory growth. The highest threat from this vulnerability is to system availability.
Other sources
HTTP/2 flood using HEADERS frames with invalid HTTP headers and queuing of response RSTSTREAM frames that results in unbounded memory growth.
— Red Hat
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RSTSTREAM frames from the peer. Depending on how the peer queues the RSTSTREAM frames, this can consume excess memory, CPU, or both.
Specific Go Packages Affected golang.org/x/net/http2
— GitHub
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RSTSTREAM frames from the peer. Depending on how the peer queues the RSTSTREAM frames, this can consume excess memory, CPU, or both.
Affected Software
212 affected componentsFixes available
redhat/go-toolset<1.11-0:1.11.13-1.el7
1.11-0:1.11.13-1.el7
redhat/go-toolset<1.11-golang-0:1.11.13-2.el7
1.11-golang-0:1.11.13-2.el7
redhat/containernetworking-plugins<0:0.8.1-4.el7_7
0:0.8.1-4.el7_7
redhat/eap7-apache-cxf<0:3.2.10-1.redhat_00001.1.el6ea
0:3.2.10-1.redhat_00001.1.el6ea
redhat/eap7-byte-buddy<0:1.9.11-1.redhat_00002.1.el6ea
0:1.9.11-1.redhat_00002.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-5.SP3_redhat_00003.1.el6ea
0:2.3.5-5.SP3_redhat_00003.1.el6ea
redhat/eap7-hal-console<0:3.0.17-2.Final_redhat_00001.1.el6ea
0:3.0.17-2.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.13-1.Final_redhat_00001.1.el6ea
0:5.3.13-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.18-1.Final_redhat_00001.1.el6ea
0:1.4.18-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-genericjms<0:2.0.2-1.Final_redhat_00001.1.el6ea
0:2.0.2-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-msc<0:1.4.11-1.Final_redhat_00001.1.el6ea
0:1.4.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-remoting<0:5.0.16-2.Final_redhat_00001.1.el6ea
0:5.0.16-2.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.3.1-6.Final_redhat_00006.1.el6ea
0:1.3.1-6.Final_redhat_00006.1.el6ea
redhat/eap7-jboss-xnio-base<0:3.7.6-2.SP1_redhat_00001.1.el6ea
0:3.7.6-2.SP1_redhat_00001.1.el6ea
redhat/eap7-picketbox<0:5.0.3-6.Final_redhat_00005.1.el6ea
0:5.0.3-6.Final_redhat_00005.1.el6ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00009.1.el6ea
0:2.5.5-20.SP12_redhat_00009.1.el6ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00009.1.el6ea
0:2.5.5-20.SP12_redhat_00009.1.el6ea
redhat/eap7-resteasy<0:3.6.1-7.SP7_redhat_00001.1.el6ea
0:3.6.1-7.SP7_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.26-2.SP3_redhat_00001.1.el6ea
0:2.0.26-2.SP3_redhat_00001.1.el6ea
redhat/eap7-wildfly<0:7.2.5-4.GA_redhat_00002.1.el6ea
0:7.2.5-4.GA_redhat_00002.1.el6ea
redhat/eap7-wildfly-elytron<0:1.6.5-1.Final_redhat_00001.1.el6ea
0:1.6.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-elytron-tool<0:1.4.4-1.Final_redhat_00001.1.el6ea
0:1.4.4-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-http-client<0:1.0.17-1.Final_redhat_00001.1.el6ea
0:1.0.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-wildfly-openssl<0:1.0.8-1.Final_redhat_00001.1.el6ea
0:1.0.8-1.Final_redhat_00001.1.el6ea
redhat/eap7-yasson<0:1.0.5-1.redhat_00001.1.el6ea
0:1.0.5-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.2.10-1.redhat_00001.1.el7ea
0:3.2.10-1.redhat_00001.1.el7ea
redhat/eap7-byte-buddy<0:1.9.11-1.redhat_00002.1.el7ea
0:1.9.11-1.redhat_00002.1.el7ea
redhat/eap7-glassfish-jsf<0:2.3.5-5.SP3_redhat_00003.1.el7ea
0:2.3.5-5.SP3_redhat_00003.1.el7ea
redhat/eap7-hal-console<0:3.0.17-2.Final_redhat_00001.1.el7ea
0:3.0.17-2.Final_redhat_00001.1.el7ea
redhat/eap7-hibernate<0:5.3.13-1.Final_redhat_00001.1.el7ea
0:5.3.13-1.Final_redhat_00001.1.el7ea
redhat/eap7-ironjacamar<0:1.4.18-1.Final_redhat_00001.1.el7ea
0:1.4.18-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-genericjms<0:2.0.2-1.Final_redhat_00001.1.el7ea
0:2.0.2-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-msc<0:1.4.11-1.Final_redhat_00001.1.el7ea
0:1.4.11-1.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-remoting<0:5.0.16-2.Final_redhat_00001.1.el7ea
0:5.0.16-2.Final_redhat_00001.1.el7ea
redhat/eap7-jboss-server-migration<0:1.3.1-6.Final_redhat_00006.1.el7ea
0:1.3.1-6.Final_redhat_00006.1.el7ea
redhat/eap7-jboss-xnio-base<0:3.7.6-2.SP1_redhat_00001.1.el7ea
0:3.7.6-2.SP1_redhat_00001.1.el7ea
redhat/eap7-picketbox<0:5.0.3-6.Final_redhat_00005.1.el7ea
0:5.0.3-6.Final_redhat_00005.1.el7ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00009.1.el7ea
0:2.5.5-20.SP12_redhat_00009.1.el7ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00009.1.el7ea
0:2.5.5-20.SP12_redhat_00009.1.el7ea
redhat/eap7-resteasy<0:3.6.1-7.SP7_redhat_00001.1.el7ea
0:3.6.1-7.SP7_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.26-2.SP3_redhat_00001.1.el7ea
0:2.0.26-2.SP3_redhat_00001.1.el7ea
redhat/eap7-wildfly<0:7.2.5-4.GA_redhat_00002.1.el7ea
0:7.2.5-4.GA_redhat_00002.1.el7ea
redhat/eap7-wildfly-elytron<0:1.6.5-1.Final_redhat_00001.1.el7ea
0:1.6.5-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-elytron-tool<0:1.4.4-1.Final_redhat_00001.1.el7ea
0:1.4.4-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-http-client<0:1.0.17-1.Final_redhat_00001.1.el7ea
0:1.0.17-1.Final_redhat_00001.1.el7ea
redhat/eap7-wildfly-openssl<0:1.0.8-1.Final_redhat_00001.1.el7ea
0:1.0.8-1.Final_redhat_00001.1.el7ea
redhat/eap7-yasson<0:1.0.5-1.redhat_00001.1.el7ea
0:1.0.5-1.redhat_00001.1.el7ea
redhat/eap7-apache-cxf<0:3.2.10-1.redhat_00001.1.el8ea
0:3.2.10-1.redhat_00001.1.el8ea
redhat/eap7-byte-buddy<0:1.9.11-1.redhat_00002.1.el8ea
0:1.9.11-1.redhat_00002.1.el8ea
redhat/eap7-glassfish-jsf<0:2.3.5-5.SP3_redhat_00003.1.el8ea
0:2.3.5-5.SP3_redhat_00003.1.el8ea
redhat/eap7-hal-console<0:3.0.17-2.Final_redhat_00001.1.el8ea
0:3.0.17-2.Final_redhat_00001.1.el8ea
redhat/eap7-hibernate<0:5.3.13-1.Final_redhat_00001.1.el8ea
0:5.3.13-1.Final_redhat_00001.1.el8ea
redhat/eap7-ironjacamar<0:1.4.18-1.Final_redhat_00001.1.el8ea
0:1.4.18-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-genericjms<0:2.0.2-1.Final_redhat_00001.1.el8ea
0:2.0.2-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-msc<0:1.4.11-1.Final_redhat_00001.1.el8ea
0:1.4.11-1.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-remoting<0:5.0.16-2.Final_redhat_00001.1.el8ea
0:5.0.16-2.Final_redhat_00001.1.el8ea
redhat/eap7-jboss-server-migration<0:1.3.1-6.Final_redhat_00006.1.el8ea
0:1.3.1-6.Final_redhat_00006.1.el8ea
redhat/eap7-jboss-xnio-base<0:3.7.6-2.SP1_redhat_00001.1.el8ea
0:3.7.6-2.SP1_redhat_00001.1.el8ea
redhat/eap7-picketbox<0:5.0.3-6.Final_redhat_00005.1.el8ea
0:5.0.3-6.Final_redhat_00005.1.el8ea
redhat/eap7-picketlink-bindings<0:2.5.5-20.SP12_redhat_00009.1.el8ea
0:2.5.5-20.SP12_redhat_00009.1.el8ea
redhat/eap7-picketlink-federation<0:2.5.5-20.SP12_redhat_00009.1.el8ea
0:2.5.5-20.SP12_redhat_00009.1.el8ea
redhat/eap7-resteasy<0:3.6.1-7.SP7_redhat_00001.1.el8ea
0:3.6.1-7.SP7_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.0.26-2.SP3_redhat_00001.1.el8ea
0:2.0.26-2.SP3_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.2.5-4.GA_redhat_00002.1.el8ea
0:7.2.5-4.GA_redhat_00002.1.el8ea
redhat/eap7-wildfly-elytron<0:1.6.5-1.Final_redhat_00001.1.el8ea
0:1.6.5-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-elytron-tool<0:1.4.4-1.Final_redhat_00001.1.el8ea
0:1.4.4-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.0.17-1.Final_redhat_00001.1.el8ea
0:1.0.17-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-openssl<0:1.0.8-1.Final_redhat_00001.1.el8ea
0:1.0.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-yasson<0:1.0.5-1.redhat_00001.1.el8ea
0:1.0.5-1.redhat_00001.1.el8ea
redhat/atomic-openshift<0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
redhat/apb<0:1.9.8-1.el7
0:1.9.8-1.el7
redhat/atomic-openshift<0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
redhat/cri-tools<0:1.11.1-2.rhaos3.11.gitedabfb5.el7
0:1.11.1-2.rhaos3.11.gitedabfb5.el7
redhat/openshift-monitor-project-lifecycle<0:3.11.51-2.git.59.7b59e29.el7
0:3.11.51-2.git.59.7b59e29.el7
redhat/cri-o<0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7
0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7
redhat/atomic-enterprise-service-catalog<1:3.11.154-1.git.1.fa68ced.el7
1:3.11.154-1.git.1.fa68ced.el7
redhat/atomic-openshift-cluster-autoscaler<0:3.11.154-1.git.1.532da7a.el7
0:3.11.154-1.git.1.532da7a.el7
redhat/atomic-openshift-descheduler<0:3.11.154-1.git.1.1d31032.el7
0:3.11.154-1.git.1.1d31032.el7
redhat/atomic-openshift-metrics-server<0:3.11.154-1.git.1.6a6b6ce.el7
0:3.11.154-1.git.1.6a6b6ce.el7
redhat/atomic-openshift-node-problem-detector<0:3.11.154-1.git.1.5e8e065.el7
0:3.11.154-1.git.1.5e8e065.el7
redhat/atomic-openshift-service-idler<0:3.11.154-1.git.1.f80fb86.el7
0:3.11.154-1.git.1.f80fb86.el7
redhat/atomic-openshift-web-console<0:3.11.154-1.git.1.f54cb18.el7
0:3.11.154-1.git.1.f54cb18.el7
redhat/cockpit<0:195-2.rhaos.el7
0:195-2.rhaos.el7
redhat/csi-attacher<0:0.2.0-4.git27299be.el7
0:0.2.0-4.git27299be.el7
redhat/csi-driver-registrar<0:0.2.0-2.el7
0:0.2.0-2.el7
redhat/csi-livenessprobe<0:0.0.1-2.gitff5b6a0.el7
0:0.0.1-2.gitff5b6a0.el7
redhat/csi-provisioner<0:0.2.0-3.el7
0:0.2.0-3.el7
redhat/golang-github-openshift-oauth-proxy<0:3.11.154-1.git.1.220e3dc.el7
0:3.11.154-1.git.1.220e3dc.el7
redhat/golang-github-openshift-prometheus-alert-buffer<0:0-3.gitceca8c1.el7
0:0-3.gitceca8c1.el7
redhat/golang-github-prometheus-alertmanager<0:3.11.154-1.git.1.4acd2e6.el7
0:3.11.154-1.git.1.4acd2e6.el7
redhat/golang-github-prometheus-prometheus<0:3.11.154-1.git.1.148db48.el7
0:3.11.154-1.git.1.148db48.el7
redhat/hawkular-openshift-agent<0:1.2.2-3.el7
0:1.2.2-3.el7
redhat/heapster<0:1.3.0-4.el7
0:1.3.0-4.el7
redhat/image-inspector<0:2.4.0-4.el7
0:2.4.0-4.el7
redhat/openshift-enterprise-autoheal<0:3.11.154-1.git.1.13199be.el7
0:3.11.154-1.git.1.13199be.el7
redhat/openshift-enterprise-cluster-capacity<0:3.11.154-1.git.1.5798c2c.el7
0:3.11.154-1.git.1.5798c2c.el7
redhat/openshift-eventrouter<0:0.2-4.git7c289cc.el7
0:0.2-4.git7c289cc.el7
redhat/openshift-external-storage<0:0.0.2-9.gitd3c94f0.el7
0:0.0.2-9.gitd3c94f0.el7
redhat/ansible-service-broker<0:1.1.20-2.el7
0:1.1.20-2.el7
redhat/atomic-openshift<0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
redhat/atomic-openshift-descheduler<0:3.9.13-2.git.267.bb59a3f.el7
0:3.9.13-2.git.267.bb59a3f.el7
redhat/atomic-openshift-dockerregistry<0:3.9.101-1.git.1.13625cf.el7
0:3.9.101-1.git.1.13625cf.el7
redhat/atomic-openshift-node-problem-detector<0:3.9.13-2.git.167.5d6b0d4.el7
0:3.9.13-2.git.167.5d6b0d4.el7
redhat/atomic-openshift-web-console<0:3.9.101-1.git.1.601c6d2.el7
0:3.9.101-1.git.1.601c6d2.el7
redhat/containernetworking-plugins<0:0.5.2-6.el7
0:0.5.2-6.el7
redhat/cri-o<0:1.9.16-3.git858756d.el7
0:1.9.16-3.git858756d.el7
redhat/cri-tools<0:1.0.0-6.rhaos3.9.git8e6013a.el7
0:1.0.0-6.rhaos3.9.git8e6013a.el7
redhat/golang-github-openshift-oauth-proxy<0:2.1-3.git885c9f40.el7
0:2.1-3.git885c9f40.el7
redhat/golang-github-prometheus-alertmanager<0:0.14.0-2.git30af4d0.el7
0:0.14.0-2.git30af4d0.el7
redhat/golang-github-prometheus-prometheus<0:2.2.1-2.gitbc6058c.el7
0:2.2.1-2.gitbc6058c.el7
redhat/golang-github-prometheus-promu<0:0-5.git85ceabc.el7
0:0-5.git85ceabc.el7
redhat/image-inspector<0:2.1.3-2.el7
0:2.1.3-2.el7
redhat/openshift-enterprise-image-registry<0:3.8.0-2.git.216.b6b90bb.el7
0:3.8.0-2.git.216.b6b90bb.el7
redhat/openshift-eventrouter<0:0.1-3.git5bd9251.el7
0:0.1-3.git5bd9251.el7
redhat/openshift-external-storage<0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
redhat/openvswitch-ovn-kubernetes<0:0.1.0-3.el7
0:0.1.0-3.el7
redhat/ansible-service-broker<1:1.4.4-2.el7
1:1.4.4-2.el7
redhat/atomic-enterprise-service-catalog<1:4.1.14-201908290858.git.1.28cc9ff.el7
1:4.1.14-201908290858.git.1.28cc9ff.el7
redhat/openshift<0:4.1.14-201908290858.git.0.3bd3467.el7
0:4.1.14-201908290858.git.0.3bd3467.el7
redhat/cri-o<0:1.13.11-0.10.dev.rhaos4.1.gitbdeb2ca.el7
0:1.13.11-0.10.dev.rhaos4.1.gitbdeb2ca.el7
redhat/cri-tools<0:1.13.0-3.rhaos4.1.gitb69a0b9.el8
0:1.13.0-3.rhaos4.1.gitb69a0b9.el8
redhat/faq<0:0.0.6-4.el7
0:0.0.6-4.el7
redhat/ignition<0:0.32.0-2.git5941fc0.el8
0:0.32.0-2.git5941fc0.el8
redhat/openshift-external-storage<0:0.0.2-7.gitd3c94f0.el7
0:0.0.2-7.gitd3c94f0.el7
redhat/pivot<0:0.0.5-2.el8
0:0.0.5-2.el8
redhat/ansible-operator<0:0.0.1-3.git.59.4beb3d2.el7
0:0.0.1-3.git.59.4beb3d2.el7
redhat/apb<0:2.0.3-2.el7
0:2.0.3-2.el7
redhat/containernetworking-plugins<0:0.8.1-4.el7
0:0.8.1-4.el7
redhat/openshift-eventrouter<0:0.2-3.gited73fb6.el7
0:0.2-3.gited73fb6.el7
redhat/golang-github-prometheus-promu<0:0.5.0-2.git642a960.el7
0:0.5.0-2.git642a960.el7
redhat/skydive<0:0.20.5-2.el7
0:0.20.5-2.el7
redhat/rh-sso7-keycloak<0:4.8.15-1.Final_redhat_00001.1.el6
0:4.8.15-1.Final_redhat_00001.1.el6
redhat/rh-sso7-keycloak<0:4.8.15-1.Final_redhat_00001.1.el7
0:4.8.15-1.Final_redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:4.8.15-1.Final_redhat_00001.1.el8
0:4.8.15-1.Final_redhat_00001.1.el8
redhat/rh-nodejs10<0:3.2-3.el7
0:3.2-3.el7
redhat/rh-nodejs10-nodejs<0:10.16.3-3.el7
0:10.16.3-3.el7
redhat/rh-nodejs8<0:3.0-5.el7
0:3.0-5.el7
redhat/rh-nodejs8-nodejs<0:8.16.1-2.el7
0:8.16.1-2.el7
go/golang.org/x/net<0.0.0-20190813141303-74dc4d7220e7
0.0.0-20190813141303-74dc4d7220e7
All of the following
Apple Swiftnio>=1.0.0<=1.4.0
Any of the following
Apple iOS and macOS>=10.12
Canonical Ubuntu Linux>=14.04
Apache Traffic Server>=6.0.0<=6.2.3
Apache Traffic Server>=7.0.0<=7.1.6
Apache Traffic Server>=8.0.0<=8.0.3
Debian Debian Linux=10.0
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=19.04
Debian Debian Linux=9.0
Synology Skynas
Synology Diskstation Manager=6.2
All of the following
Synology Vs960hd Firmware
Synology Vs960hd
Fedoraproject Fedora=29
Fedoraproject Fedora=30
openSUSE Leap=15.0
openSUSE Leap=15.1
redhat Developer Tools=1.0
redhat JBoss Core Services=1.0
redhat JBoss Enterprise Application Platform=7.2.0
redhat JBoss Enterprise Application Platform=7.3.0
redhat OpenShift Container Platform=3.9
redhat OpenShift Container Platform=3.10
redhat OpenShift Container Platform=3.11
redhat OpenShift Container Platform=4.1
redhat OpenShift Container Platform=4.2
redhat Openshift Service Mesh=1.0
redhat Openstack=14
redhat Quay=3.0.0
redhat Single Sign-on=7.3
redhat Software Collections=1.0
redhat Enterprise Linux=8.0
redhat Enterprise Linux Eus=8.1
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Workstation=7.0
Oracle GraalVM=19.2.0
McAfee Web Gateway>=7.7.2.0<7.7.2.24
McAfee Web Gateway>=7.8.2.0<7.8.2.13
McAfee Web Gateway>=8.1.0<8.2.0
NetApp Cloud Insights
NetApp Trident
F5 Big-ip Local Traffic Manager>=11.6.1<11.6.5.1
F5 Big-ip Local Traffic Manager>=12.1.0<12.1.5.1
F5 Big-ip Local Traffic Manager>=13.1.0<13.1.3.2
F5 Big-ip Local Traffic Manager>=14.0.0<14.0.1.1
F5 Big-ip Local Traffic Manager>=14.1.0<14.1.2.1
F5 Big-ip Local Traffic Manager>=15.0.0<15.0.1.1
Nodejs Node.js>=8.0.0<=8.8.1
Nodejs Node.js>=8.9.0<8.16.1
Nodejs Node.js>=10.0.0<=10.12.0
Nodejs Node.js>=10.13.0<10.16.3
Nodejs Node.js>=12.0.0<12.8.1
Apple Swiftnio>=1.0.0<=1.4.0
Apple iOS and macOS>=10.12
Canonical Ubuntu Linux>=14.04
Synology Diskstation Manager=6.2
Synology Vs960hd Firmware
Synology Vs960hd
redhat/envoy<1.11.1
1.11.1
redhat/golang<1.11.13
1.11.13
redhat/golang<1.12.8
1.12.8
redhat/Nodejs<8.16.1
8.16.1
redhat/Nodejs<10.16.3
10.16.3
redhat/Nodejs<12.8.1
12.8.1
redhat/gRPC-Go<1.21.3
1.21.3
redhat/gRPC-Go<1.22.2
1.22.2
redhat/gRPC-Go<1.23.0
1.23.0
debian/h2o
2.2.5+dfsg2-62.2.5+dfsg2-7
debian/nodejs
12.22.12~dfsg-1~deb11u412.22.12~dfsg-1~deb11u718.20.4+dfsg-1~deb12u120.19.2+dfsg-120.19.2+dfsg-1+deb13u222.22.2+dfsg+~cs22.19.15-324.15.0+dfsg+~cs24.12.2-1
debian/rust-h2<=0.3.13-2
0.4.7-30.4.13-1
debian/trafficserver
8.1.10+ds-1~deb11u18.1.11+ds-0+deb11u29.2.5+ds-0+deb12u39.2.5+ds-0+deb12u49.2.5+ds-1
Remediation
Event History
Aug 1, 2019
Data Sourced
via Red Hat·11:43 AM
DescriptionSeverityAffected Software
Aug 13, 2019
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
May 24, 2022
Advisory Published
via GitHub·04:53 PM
Feb 20, 2026
Data Sourced
via Ubuntu·10:40 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Launchpad·10:41 PM
Description
Apr 28, 2026
Data Sourced
via Debian·11:23 PM
DescriptionAffected Software
Parent advisories
This vulnerability appears in the following advisories.
- RHSA-2020:0922
- RHSA-2020:1445
- RHSA-2020:3196
- RHSA-2019:2682
- RHSA-2020:0406
- RHSA-2019:2726
- RHSA-2019:2925
- RHSA-2019:4269
- RHSA-2019:4273
- RHSA-2019:4352
- RHSA-2020:0727
- RHSA-2019:4021
- RHSA-2019:4018
- RHSA-2019:4019
- RHSA-2019:4020
- RHSA-2020:2565
- RHSA-2019:3892
- RHSA-2020:0983
- RHSA-2019:2690
- RHBA-2019:3139
- RHSA-2019:2817
- RHSA-2019:3906
- RHSA-2019:2769
- RHBA-2019:2819
- RHSA-2019:2594
- RHSA-2019:2661
- RHSA-2019:2766
- RHSA-2019:2861
- RHSA-2019:3131
- RHSA-2019:3265
- RHSA-2019:3245
- RHSA-2019:2796
- RHSA-2020:3197
- RHSA-2019:2966
- RHSA-2019:4045
- RHSA-2019:4040
- RHSA-2019:4041
- RHSA-2019:4042
- RHSA-2019:2939
- RHSA-2019:2955
- RHSA-2020:2067
Frequently Asked Questions
1
What is the severity of CVE-2019-9514?
The severity of CVE-2019-9514 is classified as high, primarily affecting system availability through unbounded memory growth.
2
How do I fix CVE-2019-9514?
To fix CVE-2019-9514, update affected software to the latest versions specified in the remediation section of the vulnerability.
3
Which software is affected by CVE-2019-9514?
CVE-2019-9514 affects various Red Hat packages including go-toolset, eap7-apache-cxf, containernetworking-plugins, and several versions of the JBoss application server.
4
What type of attack does CVE-2019-9514 enable?
CVE-2019-9514 enables an attacker to perform a denial-of-service attack by flooding a server with invalid HTTP/2 header frames.
5
Can CVE-2019-9514 affect both Apache and Go applications?
Yes, CVE-2019-9514 can affect applications using Apache Traffic Server as well as those built with Go language due to mismanagement of HTTP/2.