Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntucveUbuntu.comUB:CVE-2019-9514
HistoryAug 13, 2019 - 12:00 a.m.

CVE-2019-9514

2019-08-1300:00:00
ubuntu.com
ubuntu.com
29

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.821 High

EPSS

Percentile

98.4%

JSON

Some HTTP/2 implementations are vulnerable to a reset flood, potentially
leading to a denial of service. The attacker opens a number of streams and
sends an invalid request over each stream that should solicit a stream of
RST_STREAM frames from the peer. Depending on how the peer queues the
RST_STREAM frames, this can consume excess memory, CPU, or both.

Bugs

Notes

Author Note
sbeattie nginx added http2 support in 1.9.5 nginx previously fixed issue for CVE-2018-16844 netty added http2 support in 4.1.0 twisted added http2 support in 16.3 trafficserver enabled http2 support by default in 7.0
mdeslaur Packages built using golang need to be rebuilt once the vulnerability has been fixed. This CVE entry does not list packages that need rebuilding outside of the main repository or the Ubuntu variants with PPA overlays.
sahnaseredini nodejs patch is a version upgrade

Related

redhatcve 2
cvelist 2
nginx 1
cve 3
nvd 3
veracode 2
prion 2
ubuntucve 3
osv 17
gitlab 2
alpinelinux 2
debiancve 2
f5 1
cgr 1
github 2
wolfi 1
cbl_mariner 1
nessus 62
mscve 1
symantec 1
openvas 23
photon 4
ibm 8
altlinux 4
amazon 3
redhat 17
rocky 1
freebsd 4
almalinux 2
oraclelinux 2
debian 4
mageia 3
suse 6
fedora 2
ubuntu 2
archlinux 2
arista 1
redhatcve
redhatcve
CVE-2018-16844
2020-03-21 01:52:38
CVE-2019-9514
2021-08-01 15:46:55
cvelist
cvelist
CVE-2018-16844
2018-11-07 14:00:00
CVE-2019-9514 Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
2019-08-13 00:00:00
nginx
nginx
Excessive CPU usage in HTTP/2
2018-11-07 14:29:00
cve
cve
CVE-2018-16844
2018-11-07 14:29:00
CVE-2019-9514
2019-08-13 21:15:12
CVE-2019-14990
2019-08-13 18:15:12
nvd
nvd
CVE-2018-16844
2018-11-07 14:29:00
CVE-2019-9514
2019-08-13 21:15:12
CVE-2019-14990
2019-08-13 18:15:12
veracode
veracode
Denial Of Service (DoS) Through CPU Exhaustion
2019-05-16 03:22:55
Denial Of Service (DoS) Via Reset Signal Floods
2019-09-04 12:13:52
prion
prion
Default configuration
2018-11-07 14:29:00
Design/Logic Flaw
2019-08-13 21:15:00
ubuntucve
ubuntucve
CVE-2018-16844
2018-11-06 00:00:00
CVE-2019-9512
2019-08-13 00:00:00
CVE-2019-9515
2019-08-13 00:00:00
osv
osv
CVE-2018-16844
2018-11-07 14:29:00
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
2024-01-17 12:00:00
Reset flood in net/http and golang.org/x/net/http
2022-08-01 22:20:53
gitlab
gitlab
Allocation of Resources Without Limits or Throttling
2022-05-24 00:00:00
Allocation of Resources Without Limits or Throttling
2022-05-24 00:00:00
alpinelinux
alpinelinux
CVE-2018-16844
2018-11-07 14:29:00
CVE-2019-9514
2019-08-13 21:15:12
debiancve
debiancve
CVE-2018-16844
2018-11-07 14:29:00
CVE-2019-9514
2019-08-13 21:15:12
f5
f5
K01988340 : HTTP/2 Reset Flood vulnerability CVE-2019-9514
2019-08-20 00:00:00
cgr
cgr
CVE-2019-9514 vulnerabilities
2024-05-19 03:07:16
github
github
golang.org/x/net/http vulnerable to a reset flood
2022-05-24 16:53:19
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
2022-03-14 22:45:11
wolfi
wolfi
CVE-2019-9514 vulnerabilities
2024-07-01 09:08:36
cbl_mariner
cbl_mariner
CVE-2019-9514 affecting package python-tensorboard for versions less than 2.16.2-1
2024-05-17 21:38:35
nessus
nessus
F5 Networks BIG-IP : HTTP/2 Reset Flood vulnerability (K01988340)
2019-09-25 00:00:00
Photon OS 2.0: Nginx PHSA-2019-2.0-0117
2019-02-07 00:00:00
RHEL 7 : OpenShift Container Platform 3.11 HTTP/2 (RHSA-2019:3906) (Ping Flood) (Reset Flood)
2019-11-20 00:00:00
mscve
mscve
HTTP/2 Server Denial of Service Vulnerability
2019-08-13 07:00:00
symantec
symantec
Microsoft Windows 'HTTP.sys' CVE-2019-9514 Denial of Service Vulnerability
2019-08-13 00:00:00
openvas
openvas
nginx 1.9.5 < 1.14.1, 1.15.x < 1.15.6 Multiple Vulnerabilities
2018-11-12 00:00:00
Debian: Security Advisory (DLA-2485-1)
2020-12-09 00:00:00
Mageia: Security Advisory (MGASA-2020-0468)
2022-01-28 00:00:00
photon
photon
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2018-1.0-0201
2018-12-20 00:00:00
Home Download Photon OS User Documentation FAQ Security Advisories Related Information Lightwave - PHSA-2019-2.0-0117
2019-01-04 00:00:00
Important Photon OS Security Update - PHSA-2019-0117
2019-01-04 00:00:00
ibm
ibm
Security Bulletin: API Connect V2018 is impacted by a vulnerability in nginx (CVE-2018-16843 CVE-2018-16844)
2019-08-13 20:10:31
Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Go (CVE-2019-9512, CVE-2019-9514)
2019-11-23 15:51:35
Security Bulletin: A security vulnerability has been identified in nginx shipped with PowerAI Vision
2020-01-08 04:40:42
altlinux
altlinux
Security fix for the ALT Linux 10 package kubernetes version 1.15.3-alt1
2019-09-26 00:00:00
Security fix for the ALT Linux 10 package traefik version 1.7.14-alt1
2019-08-23 00:00:00
Security fix for the ALT Linux 9 package nginx version 1.14.1-alt1
2018-11-06 00:00:00
amazon
amazon
Medium: nginx
2018-12-13 17:27:00
Important: golang
2019-08-23 03:20:00
Important: golang
2019-08-23 16:58:00
redhat
redhat
(RHSA-2019:2726) Important: go-toolset:rhel8 security and bug fix update
2019-09-10 10:40:48
(RHSA-2019:3906) Important: OpenShift Container Platform 3.11 HTTP/2 security update
2019-11-18 16:18:29
(RHSA-2020:0406) Important: containernetworking-plugins security update
2020-02-04 18:54:49
rocky
rocky
container-tools:1.0 security update
2019-12-17 09:20:02
freebsd
freebsd
traefik -- Denial of service in HTTP/2
2019-08-13 00:00:00
NGINX -- Multiple vulnerabilities
2018-11-06 00:00:00
h2o -- multiple HTTP/2 vulnerabilities
2019-08-13 00:00:00
almalinux
almalinux
Important: container-tools:1.0 security update
2019-12-17 09:20:02
Important: container-tools:rhel8 security and bug fix update
2019-12-17 09:19:28
oraclelinux
oraclelinux
go-toolset:rhel8 security and bug fix update
2019-09-17 00:00:00
container-tools:1.0 security update
2020-01-03 00:00:00
debian
debian
[SECURITY] [DLA 2485-1] golang-golang-x-net-dev security update
2020-12-08 22:15:45
[SECURITY] [DSA 4335-1] nginx security update
2018-11-08 21:34:23
[SECURITY] [DSA 4508-1] h2o security update
2019-08-24 14:44:01
mageia
mageia
Updated golang-googlecode-net package fixes security vulnerabilities
2020-12-22 00:47:06
Updated nginx package fixes security vulnerabilities
2018-11-18 01:23:26
Updated golang packages fix security vulnerabilities
2019-09-07 00:09:08
suse
suse
Security update for nginx (moderate)
2019-02-18 00:00:00
Security update for go1.12 (moderate)
2019-09-07 00:00:00
Security update for go1.12 (moderate)
2019-09-14 00:00:00
fedora
fedora
[SECURITY] Fedora 29 Update: nginx-1.14.1-2.fc29
2018-11-24 02:29:55
[SECURITY] Fedora 30 Update: golang-1.12.9-1.fc30
2019-09-06 12:35:05
ubuntu
ubuntu
nginx vulnerabilities
2018-11-07 00:00:00
Netty vulnerabilities
2021-06-29 00:00:00
archlinux
archlinux
[ASA-201908-15] go: multiple issues
2019-08-24 00:00:00
[ASA-201908-16] go-pie: multiple issues
2019-08-24 00:00:00
arista
arista
Security Advisory 0043
2019-11-06 00:00:00

7.8 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

0.821 High

EPSS

Percentile

98.4%

JSON
Related for UB:CVE-2019-9514
redhatcve2cvelist2nginx1cve3nvd3veracode2prion2ubuntucve3osv17gitlab2alpinelinux2debiancve2f51cgr1github2wolfi1cbl_mariner1nessus62mscve1symantec1openvas23photon4ibm8altlinux4amazon3redhat17rocky1freebsd4almalinux2oraclelinux2debian4mageia3suse6fedora2ubuntu2archlinux2arista1