CVE-2019-9511

HIGH

Published 2019-08-13T20:50:59

Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2019-9511. We'll provide specific mitigation strategies based on your environment and risk profile.

CVSS Score

V3.0

7.5

/10

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score Metrics

Exploitability: N/A Impact: N/A

EPSS Score

v2025.03.14

0.139

probability

of exploitation in the wild

There is a 13.9% chance that this vulnerability will be exploited in the wild within the next 30 days.

Updated: 2025-06-25

Exploit Probability

Percentile: 0.940

Higher than 94.0% of all CVEs

Attack Vector Metrics

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Impact Metrics

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Description

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

⚠ Unreviewed HIGH

GHSA-89fc-749h-w2fj

Advisory Details

CVSS Scoring

CVSS Score

7.5

CVSS Vector


                                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2019-9511

WEB https://access.redhat.com/errata/RHSA-2019:2692

WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5

WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD

WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS

WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M

WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7

WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD

WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5

WEB https://lists.fedoraproject.org/archives/list/[email protected]/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD

WEB https://seclists.org/bugtraq/2019/Aug/40

WEB https://seclists.org/bugtraq/2019/Sep/1

WEB https://security.netapp.com/advisory/ntap-20190823-0002

WEB https://security.netapp.com/advisory/ntap-20190823-0005

WEB https://support.f5.com/csp/article/K02591030

WEB https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSS

WEB https://support.f5.com/csp/article/K02591030?utm_source=f5support&utm_medium=RSS

WEB https://usn.ubuntu.com/4099-1

WEB https://www.debian.org/security/2019/dsa-4505

WEB https://www.debian.org/security/2019/dsa-4511

WEB https://www.debian.org/security/2020/dsa-4669

WEB https://www.oracle.com/security-alerts/cpujan2021.html

WEB https://www.oracle.com/security-alerts/cpuoct2020.html

WEB https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

WEB https://www.synology.com/security/advisory/Synology_SA_19_33

WEB https://access.redhat.com/errata/RHSA-2019:2745

WEB https://access.redhat.com/errata/RHSA-2019:2746

WEB https://access.redhat.com/errata/RHSA-2019:2775

WEB https://access.redhat.com/errata/RHSA-2019:2799

WEB https://access.redhat.com/errata/RHSA-2019:2925

WEB https://access.redhat.com/errata/RHSA-2019:2939

WEB https://access.redhat.com/errata/RHSA-2019:2949

WEB https://access.redhat.com/errata/RHSA-2019:2955

WEB https://access.redhat.com/errata/RHSA-2019:2966

WEB https://access.redhat.com/errata/RHSA-2019:3041

WEB https://access.redhat.com/errata/RHSA-2019:3932

WEB https://access.redhat.com/errata/RHSA-2019:3933

WEB https://access.redhat.com/errata/RHSA-2019:3935

WEB https://access.redhat.com/errata/RHSA-2019:4018

WEB https://access.redhat.com/errata/RHSA-2019:4019

WEB https://access.redhat.com/errata/RHSA-2019:4020

WEB https://access.redhat.com/errata/RHSA-2019:4021

WEB https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

WEB https://kb.cert.org/vuls/id/605641

WEB https://kc.mcafee.com/corporate/index?page=content&id=SB10296

WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS

WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M

WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7

WEB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD

WEB http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

WEB http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

WEB http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html

WEB http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html

WEB http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html

WEB http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html

Advisory provided by GitHub Security Advisory Database. Published: May 24, 2022, Modified: January 14, 2025

References

https://kb.cert.org/vuls/id/605641/

https://usn.ubuntu.com/4099-1/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/

https://seclists.org/bugtraq/2019/Aug/40

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LZLUYPYY3RX4ZJDWZRJIKSULYRJ4PXW7/

https://www.debian.org/security/2019/dsa-4505

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUBYAF6ED3O4XCHQ5C2HYENJLXYXZC4M/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/

https://seclists.org/bugtraq/2019/Sep/1

https://www.debian.org/security/2019/dsa-4511

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/

https://access.redhat.com/errata/RHSA-2019:2692

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html

http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html

https://access.redhat.com/errata/RHSA-2019:2745

https://access.redhat.com/errata/RHSA-2019:2746

https://access.redhat.com/errata/RHSA-2019:2775

https://access.redhat.com/errata/RHSA-2019:2799

https://access.redhat.com/errata/RHSA-2019:2925

https://access.redhat.com/errata/RHSA-2019:2939

https://access.redhat.com/errata/RHSA-2019:2949

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00003.html

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00005.html

https://access.redhat.com/errata/RHSA-2019:2955

https://access.redhat.com/errata/RHSA-2019:2966

http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html

https://access.redhat.com/errata/RHSA-2019:3041

https://access.redhat.com/errata/RHSA-2019:3933

https://access.redhat.com/errata/RHSA-2019:3935

https://access.redhat.com/errata/RHSA-2019:3932

https://access.redhat.com/errata/RHSA-2019:4018

https://access.redhat.com/errata/RHSA-2019:4019

https://access.redhat.com/errata/RHSA-2019:4021

https://access.redhat.com/errata/RHSA-2019:4020

https://www.debian.org/security/2020/dsa-4669

https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

https://www.oracle.com/security-alerts/cpuoct2020.html

https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

https://www.synology.com/security/advisory/Synology_SA_19_33

https://support.f5.com/csp/article/K02591030

https://security.netapp.com/advisory/ntap-20190823-0002/

https://security.netapp.com/advisory/ntap-20190823-0005/

https://kc.mcafee.com/corporate/index?page=content&id=SB10296

https://support.f5.com/csp/article/K02591030?utm_source=f5support&amp%3Butm_medium=RSS

https://www.oracle.com/security-alerts/cpujan2021.html

HackerOne Reports

Nginx version is disclosed in HTTP response None

hckit_02

Localize

Uncontrolled Resource Consumption

View Report

Integer Overflow Risk in HTTP/2 Proxy Window Size Calculations Medium

extramayoextracheeseextrafries

curl

Integer Overflow

View Report

Published: 2019-08-13T20:50:59

Last Modified: 2024-08-04T21:54:44.157Z

Copied to clipboard!

CVE-2019-9511

Expert Analysis

CVSS Score

EPSS Score

Attack Vector Metrics

Impact Metrics

Description

Available Exploits

Related News

GitHub Security Advisories

Advisory Details

CVSS Scoring

CVSS Score

CVSS Vector

References

References

HackerOne Reports

Request Analysis

What to expect

Request Received!