CVE-2019-9518: Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service
Vulnerability summary
CVE-2019-9518 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in apache traffic_server. EPSS estimates a 25.45% chance of exploitation in the next 30 days, higher than 97.9% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 25% (FIRST, 04-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Duplicates 1 · Related 8Timeline
- 13-08-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
CVSS metrics
8 scores · 5 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
25.45%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 25.45% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat6 products
- enterprise_linux8.0
- jboss_core_services1.0
- jboss_enterprise_application_platform7.2.0 | 7.3.0
- openshift_service_mesh1.0
- quay3.0.0
Synology3 products
Debian2 products
- trafficserver< 8.0.5+ds-1
- debian_linuxEOL9.0 | 10.0
Ubuntu2 products
- netty< 1:4.1.7-4ubuntu0.1+esm1
- trafficserverAll versions (No fix recorded)
Alpine1 product
- nodejs< 10.16.3-r0
Apache1 product
- traffic_server≥ 6.0.0, ≤ 6.2.3 | ≥ 7.0.0, ≤ 7.1.6 | ≥ 8.0.0, ≤ 8.0.3
Apple1 product
- swiftnio≥ 1.0.0, ≤ 1.4.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Fedoraproject1 product
- fedoraEOL29 | 30
Mcafee1 product
- web_gateway≥ 7.7.2.0, < 7.7.2.24 | ≥ 7.8.2.0, < 7.8.2.13 | ≥ 8.1.0, < 8.2.0
Nodejs1 product
- node.js≥ 8.0.0, ≤ 8.8.1 | ≥ 8.9.0, < 8.16.1 | ≥ 10.0.0, ≤ 10.12.0 | ≥ 10.13.0, < 10.16.3 | ≥ 12.0.0, < 12.8.1
Opensuse1 product
- leapEOL15.0 | 15.1
Oracle1 product
- graalvm19.2.0
13 vendors · 22 products
References
34 links- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.mdX Refsource MISCREPORTThird Party Advisory
Show all 34 references
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory