CVE-2019-9517

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-9517
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9517.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-9517
Downstream
Related
Published
2019-08-13T21:15:12.647Z
Modified
2026-04-16T04:39:10.305840111Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

References

Affected packages

Git / github.com/apache/httpd

Affected ranges

Type
GIT
Repo
https://github.com/apache/httpd
Events
Introduced
6e65a7f3dadcade4274ae53f734d4c35188e3786
Fixed
32a08e34411eef12ae60a7cbc3df3cb58e0c0135
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8048373d9a8bd8c7237829b56a06485d5f5bf2e4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8048373d9a8bd8c7237829b56a06485d5f5bf2e4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8048373d9a8bd8c7237829b56a06485d5f5bf2e4
Database specific 
{
    "versions": [
        {
            "introduced": "2.4.20"
        },
        {
            "fixed": "2.4.40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/apache/trafficserver
Events
Introduced
27f8e2cda9133864e6ffae0224c799fde5f10290
Last affected
eaed59510bda6f1d27854d9d3f07aace2afffc16
Introduced
6c1c6cf20e7d0e287d697a0f4181436013d17c30
Last affected
e249f4a2c70ead73b281948459eb6369b3cbfaa4
Introduced
b310e3566f58dd04ec2b15b111ec86ea70e20019
Last affected
e92757040355baa6edc8896564e2e49d5232e149
Database specific 
{
    "versions": [
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.2.3"
        },
        {
            "introduced": "7.0.0"
        },
        {
            "last_affected": "7.1.6"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.3"
        }
    ]
}
Type
GIT
Repo
https://github.com/apple/swift-nio
Events
Introduced
4fb0cc68fee45d2ae714484b5979316943ef1f24
Last affected
d94ab56d58c8559ebe5d65cc35510f40f6cc2932
Database specific 
{
    "versions": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.4.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/nodejs/node
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fa9990f3fb5b06fe94e294925246d2c136deb2c2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
cf41627411886000429bde058a6594fb7f6d6d47
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a4705f62def103757112b58bfe9a4ab9e2767284
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d683e3dda09b6b3cc6cad6fd2c106e3061a48f0d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
2291e079f22e6df1f7683a05d17364b2ab3bfdab
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c1aa949064892dbe693750686c06f4ad5673e577
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
24a3d0e71b46bdf79041eb71e46662c891ab7694
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6faf17cb45e27cb6feeff4a0da1513ea99a68b58
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f6fc46e03674ab1896792b7363ecac0665b5e0c5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3e1492ad3b7dd37ecc134bc46a7ed4f04d84070f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb66efd6052801e2f10360c51787569da0185808
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8a4d7ac6b50ff425b22a0a0a2ad7ec0ae9f31587
Introduced
2b1744b674dd5071ec4b29ab93700869e76b187c
Last affected
e5873d786249d9b6aa1d8c422f856036c2c53e5e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0a3a967d54cd7e3ea509914cbf14e0fea04dd586
Introduced
f6fc46e03674ab1896792b7363ecac0665b5e0c5
Fixed
eb66efd6052801e2f10360c51787569da0185808
Introduced
0d8021e5a4cf0a6aa3a700a361f6d42c2894f2ba
Last affected
dc6bbb44daec5584a0fbd37f0916baeff3202dba
Introduced
f76ce0a75641991bfc235775a4747c978e0e281b
Fixed
5744b466c45d5324c60f122b02681813d4496749
Introduced
cf41627411886000429bde058a6594fb7f6d6d47
Last affected
4a276cc2a960b3f9a138ac3a99c9249a63b4d472
Introduced
ab4af087e83d91a46354d765306d3543b1d85423
Fixed
75657ee41677d56a498e298b01d049aef5bf199f
Introduced
2f45ad8060e13d5ac912335096d21526f2f9602b
Fixed
787378879acfb212ed4ff824bf9f767a24a5cb43
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "15.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.2.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.3.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.1.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.2.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "19.2.0"
        },
        {
            "introduced": "17.1"
        },
        {
            "last_affected": "17.3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.1"
        },
        {
            "introduced": "8.1.0"
        },
        {
            "fixed": "8.2.0"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.8.1"
        },
        {
            "introduced": "8.9.0"
        },
        {
            "fixed": "8.16.1"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "last_affected": "10.12.0"
        },
        {
            "introduced": "10.13.0"
        },
        {
            "fixed": "10.16.3"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.8.1"
        }
    ]
}

Affected versions

1.*
1.0.0
1.1.0
1.2.0
1.2.1
1.3.0
1.3.1
1.4.0
8.*
8.0.0
8.0.0-rc4
8.0.1
8.0.1-rc0
8.0.2
8.0.2-rc0
8.0.3
8.0.3-rc0
Other
HTTPD_LDAP_1_0_0
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.6
v0.1.0
v0.1.1
v0.1.10
v0.1.100
v0.1.101
v0.1.102
v0.1.103
v0.1.104
v0.1.11
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.1.92
v0.1.93
v0.1.94
v0.1.95
v0.1.96
v0.1.97
v0.1.98
v0.1.99
v0.2.0
v0.3.0
v0.3.1
v0.3.2
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.4.0
v0.5.0
v0.5.1
v0.5.10
v0.5.2
v0.5.3
v0.5.4
v0.5.5
v0.5.5-rc1
v0.5.6
v0.5.7
v0.5.8
v0.5.9
v0.6.0
v0.6.1
v0.7.0
v0.7.2
v0.7.3
v1.*
v1.0.1
v1.0.1-release
v1.0.2
v1.0.2-release
v1.0.3
v1.0.4
v1.1.0
v1.2.0
v1.3.0
v1.4.1
v1.4.2
v1.4.3
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.7.0
v1.7.1
v10.*
v10.0.0
v10.1.0
v10.10.0
v10.11.0
v10.12.0
v10.13.0
v10.14.0
v10.14.1
v10.14.2
v10.15.0
v10.15.1
v10.15.2
v10.15.3
v10.16.0
v10.16.1
v10.16.2
v10.2.0
v10.2.1
v10.3.0
v10.4.0
v10.4.1
v10.5.0
v10.6.0
v10.7.0
v10.8.0
v10.9.0
v12.*
v12.0.0
v12.1.0
v12.2.0
v12.3.0
v12.3.1
v12.4.0
v12.5.0
v12.6.0
v12.7.0
v12.8.0
v15.*
v15.0.0
v15.0.1
v15.1.0
v17.*
v17.1.0
v17.2.0
v17.3.0
v19.*
v19.0.0
v19.0.1
v19.1.0
v19.2.0
v2.*
v2.0.0
v2.0.1
v2.0.2
v2.1.0
v2.2.0
v2.2.1
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.4.0
v2.5.0
v3.*
v3.0.0
v6.*
v6.0.0
v6.1.0
v6.2.0
v7.*
v7.0.0
v7.1.0
v7.2.0
v7.2.1
v7.3.0
v8.*
v8.0.0
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.10.0
v8.11.0
v8.11.1
v8.11.2
v8.11.3
v8.11.4
v8.12.0
v8.13.0
v8.14.0
v8.14.1
v8.15.0
v8.15.1
v8.16.0
v8.2.0
v8.2.1
v8.3.0
v8.4.0
v8.5.0
v8.6.0
v8.7.0
v8.8.0
v8.8.1
v8.9.0
v8.9.1
v8.9.2
v8.9.3
v8.9.4
v9.*
v9.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9517.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "16.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "18.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "19.04"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "29"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "30"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "7.7.2.0"
            },
            {
                "fixed": "7.7.2.24"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "7.8.2.0"
            },
            {
                "fixed": "7.8.2.13"
            }
        ]
    }
]