CVE-2019-9515: Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Vulnerability summary
CVE-2019-9515 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in apache traffic_server. EPSS estimates a 87.29% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 87% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 23 · Duplicates 1 · Related 9Timeline
- 13-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
87.29%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
Decrease -0.11 pp
From 87.40% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat9 products
- enterprise_linux8.0
- jboss_core_services1.0
- jboss_enterprise_application_platform7.2.0 | 7.3.0
- openshift_container_platform4.1
- openshift_service_mesh1.0
Ubuntu6 products
- golang-google-grpcAll versions (No fix recorded)
- grpcAll versions (No fix recorded)
- h2oAll versions (No fix recorded)
- netty< 1:4.1.7-4ubuntu0.1+esm1
- trafficserverAll versions (No fix recorded)
Alpine4 products
- containerd< 1.2.9-r0
- h2o< 2.2.6-r0
- nodejs< 10.16.3-r0
- py3-twisted< 19.10.0-r0
Debian3 products
- h2o< 2.2.5+dfsg2-3
- trafficserver< 8.0.5+ds-1
- debian_linuxEOL9.0 | 10.0
Synology3 products
Apache1 product
- traffic_server≥ 6.0.0, ≤ 6.2.3 | ≥ 7.0.0, ≤ 7.1.6 | ≥ 8.0.0, ≤ 8.0.3
Apple1 product
- swiftnio≥ 1.0.0, ≤ 1.4.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
F51 product
- big-ip_local_traffic_manager≥ 11.6.1, < 11.6.5.1 | ≥ 12.1.0, < 12.1.5.1 | ≥ 13.1.0, < 13.1.3.2 | ≥ 14.0.0, < 14.0.1.1 | ≥ 14.1.0, < 14.1.2.1 | ≥ 15.0.0, < 15.0.1.1
Fedoraproject1 product
- fedoraEOL29 | 30
Mcafee1 product
- web_gateway≥ 7.7.2.0, < 7.7.2.24 | ≥ 7.8.2.0, < 7.8.2.13 | ≥ 8.1.0, < 8.2.0
Nodejs1 product
- node.js≥ 8.0.0, ≤ 8.8.1 | ≥ 8.9.0, < 8.16.1 | ≥ 10.0.0, ≤ 10.12.0 | ≥ 10.13.0, < 10.16.3 | ≥ 12.0.0, < 12.8.1
Opensuse1 product
- leapEOL15.0 | 15.1
Oracle1 product
- graalvm19.2.0
14 vendors · 34 products
References
48 links- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdX Refsource MISCREPORTThird Party Advisory
Show all 48 references
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory