Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Scores

EPSS (exploitation in 30 days)

82.8% · top 0.3% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• CWE-400 Uncontrolled Resource Consumption (opens in a new tab)All about CWE-400 and its CVEs
• CWE-770 (opens in a new tab)All about CWE-770 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Gogolang.org/x/netGHSA-39qc-96h7-956f (opens in a new tab)

References (67)

• VU#605641 (opens in a new tab)third-party-advisoryx_transferred
• https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md (opens in a new tab)x_transferred
• [trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks (opens in a new tab)mailing-listx_transferred
• [trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks (opens in a new tab)mailing-listx_transferred
• [trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks (opens in a new tab)mailing-listx_transferred
• 20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 (opens in a new tab)mailing-listx_transferred
• 20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 (opens in a new tab)mailing-listx_transferred
• https://www.synology.com/security/advisory/Synology_SA_19_33 (opens in a new tab)x_transferred
• 20190819 [SECURITY] [DSA 4503-1] golang-1.11 security update (opens in a new tab)mailing-listx_transferred
• DSA-4503 (opens in a new tab)vendor-advisoryx_transferred
• https://support.f5.com/csp/article/K01988340 (opens in a new tab)x_transferred
• [oss-security] 20190819 [ANNOUNCE] Security release of Kubernetes v1.15.3, v1.14.6, v1.13.10 - CVE-2019-9512 and CVE-2019-9514 (opens in a new tab)mailing-listx_transferred
• https://security.netapp.com/advisory/ntap-20190823-0001/ (opens in a new tab)x_transferred
• https://security.netapp.com/advisory/ntap-20190823-0004/ (opens in a new tab)x_transferred
• https://security.netapp.com/advisory/ntap-20190823-0005/ (opens in a new tab)x_transferred
• openSUSE-SU-2019:2000 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2019-5a6a7bc12c (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2019-6a2980de56 (opens in a new tab)vendor-advisoryx_transferred
• 20190825 [SECURITY] [DSA 4508-1] h2o security update (opens in a new tab)mailing-listx_transferred
• DSA-4508 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2019:2056 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2019:2072 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2019-55d101a740 (opens in a new tab)vendor-advisoryx_transferred
• FEDORA-2019-65db7ad6c7 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2019:2085 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2682 (opens in a new tab)vendor-advisoryx_transferred
• DSA-4520 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2726 (opens in a new tab)vendor-advisoryx_transferred
• 20190910 [SECURITY] [DSA 4520-1] trafficserver security update (opens in a new tab)mailing-listx_transferred
• RHSA-2019:2594 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2019:2114 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2019:2115 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2661 (opens in a new tab)vendor-advisoryx_transferred
• https://kc.mcafee.com/corporate/index?page=content&id=SB10296 (opens in a new tab)x_transferred
• RHSA-2019:2690 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2766 (opens in a new tab)vendor-advisoryx_transferred
• openSUSE-SU-2019:2130 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2796 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2861 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2925 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2939 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2955 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2966 (opens in a new tab)vendor-advisoryx_transferred
• https://support.f5.com/csp/article/K01988340?utm_source=f5support&amp%3Butm_medium=RSS (opens in a new tab)x_transferred
• RHSA-2019:3131 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:2769 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:3245 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:3265 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:3892 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:3906 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4018 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4019 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4021 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4020 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4045 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4042 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4040 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4041 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4269 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4273 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2019:4352 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2020:0406 (opens in a new tab)vendor-advisoryx_transferred
• RHSA-2020:0727 (opens in a new tab)vendor-advisoryx_transferred
• USN-4308-1 (opens in a new tab)vendor-advisoryx_transferred
• DSA-4669 (opens in a new tab)vendor-advisoryx_transferred
• [debian-lts-announce] 20201208 [SECURITY] [DLA 2485-1] golang-golang-x-net-dev security update (opens in a new tab)mailing-listx_transferred
• [oss-security] 20231018 Re: CVE-2023-44487: HTTP/2 Rapid Reset attack against many implementations (opens in a new tab)mailing-listx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-39qc-96h7-956f (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-9514](https://trackcve.app/badge/CVE-2019-9514.svg)](https://trackcve.app/cve/CVE-2019-9514)

Record last updated 4 Aug 2024, 21:54 UTC.