7.8

CVE-2019-9512: Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Modified
AliasesALPINE-CVE-2019-9512UBUNTU-CVE-2019-9512DEBIAN-CVE-2019-9512
Published 13-08-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-9512 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in apache traffic_server. EPSS estimates a 83.43% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 83% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v2.0 (NVD)
EPSS score
83.43%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 59 · Duplicates 1 · Related 21
CGA-2J9H-PF25-8J22CGA-6FX5-75PW-H4QQCGA-C8P8-7335-FM9VCGA-CG73-26QF-J9XGCGA-FFJP-MPXW-V946CGA-HF58-VHRC-QXWP

Timeline

  1. 13-08-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS metrics

9 scores · 6 sources · 3 versions

EPSS trend

Probability

83.43%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 83.43% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat13 products
Ubuntu11 products
  • golang-1.10All versions (No fix recorded)
  • golang-1.6All versions (No fix recorded)
  • golang-1.8All versions (No fix recorded)
  • golang-1.9All versions (No fix recorded)
  • golang-google-grpcAll versions (No fix recorded)
Alpine6 products
  • containerd< 1.2.9-r0
  • go< 1.12.8-r0
  • h2o< 2.2.6-r0
  • k3s< 0.8.1-r0
  • nodejs< 10.16.3-r0
Debian3 products
  • h2o< 2.2.5+dfsg2-3
  • trafficserver< 8.0.5+ds-1
  • debian_linuxEOL10.0 | 9.0
Synology3 products
Netapp2 products
Apache1 product
  • traffic_server≥ 6.0.0, ≤ 6.2.3 | ≥ 7.0.0, ≤ 7.1.6 | ≥ 8.0.0, ≤ 8.0.3
Apple1 product
Canonical1 product
F51 product
  • big-ip_local_traffic_manager≥ 11.6.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5.1 | ≥ 13.1.0, < 13.1.3.2 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.1 | ≥ 15.0.0, < 15.0.1.1
Fedoraproject1 product
Go1 product
  • stdlib≥ 1.12.0-0, < 1.12.8
Golang.org/x1 product
  • net< 0.0.0-20190813141303-74dc4d7220e7
Mcafee1 product
  • web_gateway≥ 7.7.2.0, < 7.7.2.24 | ≥ 7.8.2.0, < 7.8.2.13 | ≥ 8.1.0, < 8.2.0
Nodejs1 product
  • node.js≥ 8.0.0, ≤ 8.8.1 | ≥ 8.9.0, < 8.16.1 | ≥ 10.0.0, ≤ 10.12.0 | ≥ 10.13.0, < 10.16.3 | ≥ 12.0.0, < 12.8.1
Opensuse1 product
Oracle1 product

17 vendors · 49 products

References

106 links
Show all 100 references

Showing 100 of 106.