Maple Labs

CVE search · CVE-2019-9517

CVE-2019-9517

high 7.5

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
cret@cert.org
Weakness
CWE-400, CWE-770

Severity

VersionScoreVectorSource
CVSS 3.1 high 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H nvd@nist.govPrimary
CVSS 3.0 high 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H cret@cert.orgSecondary
CVSS 2.0 high 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

References