Back
CVE-2019-9515
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
- 7.5HighCVSS base score
- 87.3%Exploitation in 30 daysEPSS · top 0.2% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Timeline
ID reserved
By certcc
- 6 months later
· 6 months later
Published
- 5 years later
· 5 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| certccCNA (assigner) | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 87.3% · top 0.2% of all CVEs (11 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
n/a
- affected n/a
References
References38
- VU#605641 (opens in a new tab)third-party-advisoryx_refsource_CERT-VNx_transferred
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md (opens in a new tab)x_refsource_MISCx_transferred
- [trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- 20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- https://www.synology.com/security/advisory/Synology_SA_19_33 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://support.f5.com/csp/article/K50233772 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://security.netapp.com/advisory/ntap-20190823-0005/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- FEDORA-2019-5a6a7bc12c (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- FEDORA-2019-6a2980de56 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- 20190825 [SECURITY] [DSA 4508-1] h2o security update (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- DSA-4508 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- DSA-4520 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- 20190910 [SECURITY] [DSA 4520-1] trafficserver security update (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- openSUSE-SU-2019:2114 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- openSUSE-SU-2019:2115 (opens in a new tab)vendor-advisoryx_refsource_SUSEx_transferred
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296 (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2019:2766 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:2796 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:2861 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:2925 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:2939 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:2955 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- https://support.f5.com/csp/article/K50233772?utm_source=f5support&%3Butm_medium=RSS (opens in a new tab)x_refsource_CONFIRMx_transferred
- RHSA-2019:3892 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4018 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4019 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4021 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4020 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4045 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4042 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4040 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4041 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2019:4352 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- RHSA-2020:0727 (opens in a new tab)vendor-advisoryx_refsource_REDHATx_transferred
- USN-4308-1 (opens in a new tab)vendor-advisoryx_refsource_UBUNTUx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2019-18887 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2019-9515)Record last updated .