7.5

CVE-2019-9514: Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Published
AliasesALPINE-CVE-2019-9514UBUNTU-CVE-2019-9514DEBIAN-CVE-2019-9514
Published 13-08-2019Last modified 04-08-2024

Vulnerability summary

CVE-2019-9514 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in nodejs. EPSS estimates a 82.81% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 83% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.0 (CVE.org)
EPSS score
82.81%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 58 · Duplicates 1 · Related 20
CGA-2J9H-PF25-8J22CGA-6FX5-75PW-H4QQCGA-C8P8-7335-FM9VCGA-CG73-26QF-J9XGCGA-FFJP-MPXW-V946CGA-HF58-VHRC-QXWP

Timeline

  1. 13-08-2019
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

82.81%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 82.81% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu11 products
  • golang-1.10All versions (No fix recorded)
  • golang-1.6All versions (No fix recorded)
  • golang-1.8All versions (No fix recorded)
  • golang-1.9All versions (No fix recorded)
  • golang-google-grpcAll versions (No fix recorded)
Debian4 products
  • h2o< 2.2.5+dfsg2-3
  • nodejs< 10.16.3~dfsg-1
  • rust-h2All versions (No fix recorded) | < 0.3.24-1
  • trafficserver< 8.0.5+ds-1
Alpine1 product
  • nodejs< 10.16.3-r0

3 vendors · 16 products

References

80 links
Show all 80 references