Original description
Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Affected software
- nginx ≥ 1.9.5 < 1.16.1≥ 1.17.0 ≤ 1.17.2 Fixed in: 1.16.1 exact match
Details
- Published
- 2019-08-14
- Last modified
- 2024-08-05
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- CWE
- CWE-400
- EPSS (30-day exploit probability)
- 57.46% (percentile 99)
References
- cve.org/CVE-2019-9516
- nvd.nist.gov/vuln/detail/CVE-2019-9516
- kb.cert.org/vuls/id/605641/
- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- seclists.org/bugtraq/2019/Aug/24
- usn.ubuntu.com/4099-1/
- seclists.org/fulldisclosure/2019/Aug/16
- www.synology.com/security/advisory/Synology_SA_19_33
- support.f5.com/csp/article/K02591030
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T...
- seclists.org/bugtraq/2019/Aug/40
- www.debian.org/security/2019/dsa-4505
- security.netapp.com/advisory/ntap-20190823-0002/
- security.netapp.com/advisory/ntap-20190823-0005/
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.