Skip to content
Fencer Vulns
high 7.5

CVE-2019-9512 in the critical feed json

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

published 2019-08-13 7 y ago modified 2026-09-10 1 mo ago also CVE-2019-9514 , GHSA-39qc-96h7-956f , GHSA-hgr8-6h9x-f7q9 , GO-2022-0536 , EUVD-2022-4147

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
83.4%
EPSS 83.4% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known

Summary

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Patch / fix

  • go golang.org/x/net 0.0.0-20190813141303-74dc4d7220e7
  • go stdlib 1.11.13, 1.12.8
  • nodejs node.js 8.16.1, 10.16.3, 12.8.1
  • h2o Debian 12 2.2.5+dfsg2-3
  • trafficserver Debian 12 8.0.5+ds-1

debian advisories DEBIAN-CVE-2019-9512

  • twisted Ubuntu 18.04 LTS 17.9.0-2ubuntu0.1
  • twisted Ubuntu 20.04 LTS 18.9.0-6ubuntu1
  • netty Ubuntu Pro 18.04 LTS 1:4.1.7-4ubuntu0.1+esm1

ubuntu advisories UBUNTU-CVE-2019-9512

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • runc RHEL 8 1.0.0-56.rc5.dev.git2abd837.module+el8.1.0+4908+72a45cef
  • podman RHEL 8 1.0.0-4.git921f98f.module+el8.1.0+4908+72a45cef
  • skopeo RHEL 8 1:0.1.32-6.git1715c90.module+el8.1.0+4903+9bde5d6c
  • buildah RHEL 8 1.5-6.gite94b4f9.module+el8.1.0+4908+72a45cef
  • oci-umount RHEL 8 2:2.3.4-2.git87f9237.module+el8.1.0+3468+011f0ab0
  • slirp4netns RHEL 8 0.1-3.dev.gitc4e1bc5.module+el8.1.0+4308+9d868e48
  • podman-docker RHEL 8 1.0.0-4.git921f98f.module+el8.1.0+4908+72a45cef
  • fuse-overlayfs RHEL 8 0.3-5.module+el8.1.0+3468+011f0ab0

red hat advisories RHSA-2019:4273RHSA-2019:4269RHSA-2019:2925RHSA-2019:2726RHSA-2024:5856RHSA-2020:0406

  • nodejs12 SLE Module for Web and Scripting 12 12.13.0-1.3.1
  • nodejs8 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15 8.16.1-3.20.1
  • nodejs10 SLE Module for Web and Scripting 15 SP1, SLE Module for Web and Scripting 15, SLE Module for Web and Scripting 12 10.16.3-1.12.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
  • mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1
  • firefox-cairo SLES 11 SP4-LTSS 1.15.10-2.13.4

suse advisories SUSE-SU-2019:14246-1SUSE-SU-2020:0059-1SUSE-SU-2019:2260-1SUSE-SU-2019:2259-1SUSE-SU-2019:2254-1

  • go1.11 openSUSE Tumbleweed 1.11.13-10.5
  • go1.12 openSUSE Tumbleweed 1.12.17-4.8
  • notary openSUSE Tumbleweed 0.7.0-1.2
  • python-Twisted openSUSE Tumbleweed 21.7.0-3.2
  • go1.12 openSUSE Leap 15.1 1.12.9-lp151.2.21.1
  • nodejs8 openSUSE Leap 15.1, openSUSE Leap 15.0 8.16.1-lp151.2.6.1
  • nodejs10 openSUSE Leap 15.1, openSUSE Leap 15.0 10.16.3-lp151.2.6.1
  • go1.12 openSUSE Leap 15.1 1.12.9-lp151.2.17.1

opensuse advisories openSUSE-SU-2024:10804-1openSUSE-SU-2024:10805-1openSUSE-SU-2024:11098-1openSUSE-SU-2024:11212-1openSUSE-SU-2019:2130-1openSUSE-SU-2019:2115-1

  • runc AlmaLinux 8 1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43
  • runc AlmaLinux 8 1.0.0-56.rc5.dev.git2abd837.module_el8.4.0+2496+12421f43
  • runc AlmaLinux 8 1.0.0-56.rc5.dev.git2abd837.module_el8.5.0+119+9a9ec082
  • skopeo AlmaLinux 8 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
  • skopeo AlmaLinux 8 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
  • skopeo AlmaLinux 8 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
  • oci-umount AlmaLinux 8 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43

almalinux advisories ALSA-2019:4273ALSA-2019:4269ALSA-2019:2925

  • runc Rocky Linux 8 1.0.0-56.rc5.dev.git2abd837.module+el8.5.0+681+c9a1951f
  • runc Rocky Linux 8 1.0.0-56.rc5.dev.git2abd837.module+el8.4.0+557+48ba8b2f
  • skopeo Rocky Linux 8 1:0.1.32-6.git1715c90.module+el8.5.0+681+c9a1951f
  • skopeo Rocky Linux 8 1:0.1.32-6.git1715c90.module+el8.4.0+557+48ba8b2f
  • oci-umount Rocky Linux 8 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
  • fuse-overlayfs Rocky Linux 8 0.3-5.module+el8.5.0+681+c9a1951f
  • fuse-overlayfs Rocky Linux 8 0.3-5.module+el8.4.0+557+48ba8b2f
  • oci-systemd-hook Rocky Linux 8 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f

rocky linux advisories RLSA-2019:4273RLSA-2019:4269RLSA-2019:2925

  • go Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.12.8-r0
  • h2o Alpine 3.19, Alpine 3.18, Alpine 3.17 +6 more 2.2.6-r0
  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 0.8.1-r0
  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 10.16.3-r0
  • containerd Alpine 3.24, Alpine 3.23, Alpine 3.22 +12 more 1.2.9-r0
  • py3-twisted Alpine 3.24, Alpine 3.23, Alpine 3.22 +11 more 19.10.0-r0

alpine advisories ALPINE-CVE-2019-9512

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-tensorboard Azure Linux 3.0 2.16.2-1

azure linux advisories AZL-38449

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • go Arch Linux 2:1.12.8-1

arch linux advisories AVG-1021

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-9512 updated cvss 7.5

HTTP/2: flood using PING frames results in unbounded memory growth

  • Red Hat AMQ Broker 7 jetty, netty
    affected: no fix available
  • Red Hat Ceph Storage 2 golang, golang-bin, golang-src Red Hat Ceph Storage 3 golang, grafana, golang-bin, golang-src
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 undertow-core
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Application Runtimes grpc, netty, undertow-core, rhel8/nodejs-20-minimal
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.10 cri-o, heapster, cri-tools, prometheus, csi-attacher, imagebuilder, +38 more Red Hat OpenShift Container Platform 3.11 podman, ansible-service-broker, automation-broker-apb-role, ansible-service-broker-selinux, ansible-service-broker-container-scripts Red Hat OpenShift Container Platform 4 golang-images
    affected: no fix available
  • Red Hat OpenStack Platform 9 (Mitaka) Operational Tools golang, golang-bin, golang-src
    affected: no fix planned “Will not fix”
  • Red Hat Quay 3 quay, quay-builder
    affected: no fix available
  • Red Hat Storage 3 golang, heketi, golang-bin, golang-src, golang-misc, golang-tests, +2 more
    affected: no fix available, no fix planned “Will not fix”
show 28 more
  • Red Hat Quay v3 quay3/clair-jwt v2.0.9-7
    fixed: vendor fix RHSA-2019:2966
  • Red Hat AMQ
    fixed: vendor fix RHSA-2020:0922
  • Red Hat AMQ 7.4.3
    fixed: vendor fix RHSA-2020:1445
  • Red Hat Data Grid 7.3.3
    fixed: vendor fix RHSA-2020:0727
  • Red Hat Decision Manager 7
    fixed: vendor fix RHSA-2020:3196
  • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) go-toolset-1.11 1.11.13-1.el7, go-toolset-1.11-build 1.11.13-1.el7, go-toolset-1.11-golang 1.11.13-2.el7, go-toolset-1.11-runtime 1.11.13-1.el7, go-toolset-1.11-scldevel 1.11.13-1.el7, go-toolset-1.11-golang-bin 1.11.13-2.el7, +4 more Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) go-toolset-1.11 1.11.13-1.el7, go-toolset-1.11-build 1.11.13-1.el7, go-toolset-1.11-golang 1.11.13-2.el7, go-toolset-1.11-runtime 1.11.13-1.el7, go-toolset-1.11-scldevel 1.11.13-1.el7, go-toolset-1.11-golang-bin 1.11.13-2.el7, +4 more
    fixed: vendor fix RHSA-2019:2682
  • Red Hat Enterprise Linux 7 Extras containernetworking-plugins 0.8.1-4.el7_7
    fixed: vendor fix RHSA-2020:0406
  • Red Hat Enterprise Linux AppStream (v. 8) podman 1.4.2-6.module+el8.1.0+4830+f49150d7, buildah 1.9.0-5.module+el8.1.0+4240+893c1ab8, skopeo 0.1.37-6.module+el8.1.0+4876+e678a192, toolbox 0.0.4-1.module+el8.1.0+4081+b29780af, golang 1.11.13-2.module+el8.0.1+4087+d8180914, nodejs 10.16.3-2.module+el8.0.0+4214+49953fda, +37 more
    fixed: vendor fix RHSA-2019:2925
  • Red Hat Fuse 6.3
    fixed: vendor fix RHSA-2019:4352
  • Red Hat Fuse 7.5.0
    fixed: vendor fix RHSA-2019:3892
  • Red Hat Fuse 7.6.0
    fixed: vendor fix RHSA-2020:0983
  • Red Hat JBoss EAP 7.2
    fixed: vendor fix RHSA-2019:4021
  • Red Hat JBoss EAP 7.2 for RHEL 6 Server eap7-yasson 1.0.5-1.redhat_00001.1.el6eap, eap7-wildfly 7.2.5-4.GA_redhat_00002.1.el6eap, eap7-apache-cxf 3.2.10-1.redhat_00001.1.el6eap, eap7-byte-buddy 1.9.11-1.redhat_00002.1.el6eap, eap7-resteasy 3.6.1-7.SP7_redhat_00001.1.el6eap, eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el6eap, +90 more
    fixed: vendor fix RHSA-2019:4018
  • Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-yasson 1.0.5-1.redhat_00001.1.el7eap, eap7-wildfly 7.2.5-4.GA_redhat_00002.1.el7eap, eap7-apache-cxf 3.2.10-1.redhat_00001.1.el7eap, eap7-byte-buddy 1.9.11-1.redhat_00002.1.el7eap, eap7-resteasy 3.6.1-7.SP7_redhat_00001.1.el7eap, eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el7eap, +92 more
    fixed: vendor fix RHSA-2019:4019
  • Red Hat JBoss EAP 7.2 for RHEL 8 eap7-yasson 1.0.5-1.redhat_00001.1.el8eap, eap7-wildfly 7.2.5-4.GA_redhat_00002.1.el8eap, eap7-apache-cxf 3.2.10-1.redhat_00001.1.el8eap, eap7-byte-buddy 1.9.11-1.redhat_00002.1.el8eap, eap7-resteasy 3.6.1-7.SP7_redhat_00001.1.el8eap, eap7-undertow 2.0.26-2.SP3_redhat_00001.1.el8eap, +90 more
    fixed: vendor fix RHSA-2019:4020
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-wildfly 7.1.7-2.GA_redhat_00002.1.ep7.el7, eap7-netty 4.1.45-1.Final_redhat_00001.1.ep7.el7, eap7-infinispan 8.2.11-1.SP2_redhat_00001.1.ep7.el7, eap7-undertow 1.4.18-12.SP12_redhat_00001.1.ep7.el7, eap7-netty-all 4.1.45-1.Final_redhat_00001.1.ep7.el7, eap7-wildfly-modules 7.1.7-2.GA_redhat_00002.1.ep7.el7, +9 more
    fixed: vendor fix RHSA-2024:5856
  • Red Hat JBoss Enterprise Application Platform Continuous Delivery
    fixed: vendor fix RHSA-2020:2565
  • Red Hat OpenShift Container Platform 3.9 heapster 1.3.0-4.el7, cockpit 195-2.rhaos.el7, image-inspector 2.1.3-2.el7, cri-o 1.9.16-3.git858756d.el7, prometheus 2.2.1-2.gitbc6058c.el7, cockpit-kubernetes 195-2.rhaos.el7, +41 more
    fixed: vendor fix RHSA-2019:2769
  • Red Hat OpenShift Container Platform 3.10 atomic-openshift 3.10.170-1.git.0.8e592d6.el7, atomic-openshift-pod 3.10.170-1.git.0.8e592d6.el7, atomic-openshift-node 3.10.170-1.git.0.8e592d6.el7, atomic-openshift-tests 3.10.170-1.git.0.8e592d6.el7, atomic-openshift-master 3.10.170-1.git.0.8e592d6.el7, atomic-openshift-clients 3.10.170-1.git.0.8e592d6.el7, +7 more
    fixed: vendor fix RHSA-2019:2690
  • Red Hat OpenShift Container Platform 3.11 apb 1.9.8-1.el7, heapster 1.3.0-4.el7, cockpit 195-2.rhaos.el7, csi-provisioner 0.2.0-3.el7, image-inspector 2.4.0-4.el7, csi-driver-registrar 0.2.0-2.el7, +47 more
    fixed: vendor fix RHBA-2019:3139
  • Red Hat OpenShift Container Platform 4.1 apb 2.0.3-2.el7, faq 0.0.6-4.el7, pivot 0.0.5-2.el8, ignition 0.32.0-2.git5941fc0.el8, apb-container-scripts 2.0.3-2.el7, ansible-service-broker 1.4.4-2.el7, +130 more
    fixed: vendor fix RHSA-2019:3265
  • Red Hat OpenShift Container Platform 4.2 apb 2.0.3-2.el7, apb-container-scripts 2.0.3-2.el7, containernetworking-plugins 0.8.1-4.el7, prometheus-promu 0.5.0-2.git642a960.el7, golang-github-prometheus-promu 0.5.0-2.git642a960.el7
    fixed: vendor fix RHSA-2019:3245
  • Red Hat OpenStack Platform 14.0 skydive 0.20.5-2.el7ost, skydive-agent 0.20.5-2.el7ost, skydive-ansible 0.20.5-2.el7ost, skydive-selinux 0.20.5-2.el7ost, skydive-analyzer 0.20.5-2.el7ost
    fixed: vendor fix RHSA-2019:2796
  • Red Hat Process Automation 7
    fixed: vendor fix RHSA-2020:3197
  • Red Hat Single Sign-On 7.3
    fixed: vendor fix RHSA-2019:4045
  • Red Hat Single Sign-On 7.3 for RHEL 6 Server rh-sso7-keycloak 4.8.15-1.Final_redhat_00001.1.el6sso, rh-sso7-keycloak-server 4.8.15-1.Final_redhat_00001.1.el6sso
    fixed: vendor fix RHSA-2019:4040
  • Red Hat Single Sign-On 7.3 for RHEL 7 Server rh-sso7-keycloak 4.8.15-1.Final_redhat_00001.1.el7sso, rh-sso7-keycloak-server 4.8.15-1.Final_redhat_00001.1.el7sso
    fixed: vendor fix RHSA-2019:4041
  • Red Hat Single Sign-On 7.3 for RHEL 8 rh-sso7-keycloak 4.8.15-1.Final_redhat_00001.1.el8sso, rh-sso7-keycloak-server 4.8.15-1.Final_redhat_00001.1.el8sso
    fixed: vendor fix RHSA-2019:4042

6 more fixed, 20 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

83.43% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go golang.org/x/net
<0.0.0-20190813141303-74dc4d7220e7
0.0.0-20190813141303-74dc4d7220e7
go stdlib
<1.11.13
>=1.12.0-0, <1.12.8
1.11.13
1.12.8

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-770 Allocation of Resources Without Limits or Throttling
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.