CVE-2019-9517: apache http_server Uncontrolled Resource Consumption
CVSS: 7.8v2.0HighModified
AliasesALPINE-CVE-2019-9517RHSA-2019:2893UBUNTU-CVE-2019-9517DEBIAN-CVE-2019-9517
Published 13-08-2019Last modified 04-08-2024
Vulnerability summary
CVE-2019-9517 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in apache http_server. EPSS estimates a 27.89% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
27.89%
0%100%
High · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 22 · Related 12DSA-4509-1MGASA-2019-0407MGASA-2020-0372OPENSUSE-SU-2019:2051-1OPENSUSE-SU-2019:2114-1OPENSUSE-SU-2019:2115-1OPENSUSE-SU-2024:10623-1RHSA-2019:2925RHSA-2019:2939RHSA-2019:2946RHSA-2019:2949RHSA-2019:2955RHSA-2019:3932RHSA-2019:3933SUSE-SU-2019:14246-1SUSE-SU-2019:2237-1SUSE-SU-2019:2254-1SUSE-SU-2019:2259-1SUSE-SU-2019:2260-1SUSE-SU-2019:2329-1SUSE-SU-2020:0059-1USN-4113-1
Timeline
- 13-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
CVSS metrics
9 scores · 6 sources · 3 versionsHigh 7.5Preferred score · OSV · Alpine (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
27.89%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 27.89% on 18-09-2026
18-09-202618-10-2026
EPSS score27.89%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Redhat27 products
- enterprise_linux8.0
- jboss_core_services1.0
- jboss_enterprise_application_platform7.2.0 | 7.3.0
- openshift_service_mesh1.0
- quay3.0.0
Oracle4 products
- communications_element_manager8.0.0 | 8.1.0 | 8.1.1 | 8.2.0
- graalvm19.2.0
- instantis_enterprisetrack≥ 17.1, ≤ 17.3
- retail_xstore_point_of_service7.1
Synology3 products
Alpine2 products
- apache2< 2.4.41-r0
- nodejs< 10.16.3-r0
Apache2 products
- http_server≥ 2.4.20, < 2.4.40
- traffic_server≥ 6.0.0, ≤ 6.2.3 | ≥ 7.0.0, ≤ 7.1.6 | ≥ 8.0.0, ≤ 8.0.3
Debian2 products
- apache2< 2.4.41-1
- debian_linuxEOL9.0 | 10.0
Apple1 product
- swiftnio≥ 1.0.0, ≤ 1.4.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Fedoraproject1 product
- fedoraEOL29 | 30
Mcafee1 product
- web_gateway≥ 7.7.2.0, < 7.7.2.24 | ≥ 7.8.2.0, < 7.8.2.13 | ≥ 8.1.0, < 8.2.0
Netapp1 product
Nodejs1 product
- node.js≥ 8.0.0, ≤ 8.8.1 | ≥ 8.9.0, < 8.16.1 | ≥ 10.0.0, ≤ 10.12.0 | ≥ 10.13.0, < 10.16.3 | ≥ 12.0.0, < 12.8.1
Opensuse1 product
- leapEOL15.0 | 15.1
Ubuntu1 product
- apache2< 2.4.29-1ubuntu4.10
14 vendors · 48 products
References
58 links- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdX Refsource MISCARTICLEREPORTThird Party Advisory
Show all 58 references
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- access.redhat.com/errata/RHSA-2019:2893Vendor AdvisoryX Refsource REDHATAdvisoryThird Party Advisory
- www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlX Refsource MISCPatchThird Party Advisory
