CVE-2019-9514

HIGH

SwiftNIO 1.0.0-1.3.9 - Denial of Service via HTTP/2 Reset Flood

Title source: llm
STIX 2.1

Description

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

References (67)

Core 67
Core References
Third Party Advisory, US Government Resource third-party-advisory
https://kb.cert.org/vuls/id/605641/
Mailing List, Third Party Advisory mailing-list
https://seclists.org/bugtraq/2019/Aug/24
Mailing List, Third Party Advisory mailing-list
http://seclists.org/fulldisclosure/2019/Aug/16
Mailing List, Third Party Advisory mailing-list
https://seclists.org/bugtraq/2019/Aug/31
Third Party Advisory vendor-advisory
https://www.debian.org/security/2019/dsa-4503
Mailing List, Third Party Advisory mailing-list
http://www.openwall.com/lists/oss-security/2019/08/20/1
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html
Mailing List, Third Party Advisory mailing-list
https://seclists.org/bugtraq/2019/Aug/43
Third Party Advisory vendor-advisory
https://www.debian.org/security/2019/dsa-4508
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2682
Third Party Advisory vendor-advisory
https://www.debian.org/security/2019/dsa-4520
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2726
Mailing List, Third Party Advisory mailing-list
https://seclists.org/bugtraq/2019/Sep/18
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2594
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2661
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2690
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2766
Mailing List, Third Party Advisory vendor-advisory
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2796
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2861
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2925
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2939
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2955
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2966
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:3131
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:2769
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:3245
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:3265
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:3892
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:3906
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4018
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4019
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4021
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4020
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4045
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4042
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4040
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4041
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4269
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4273
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2019:4352
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0406
Third Party Advisory vendor-advisory
https://access.redhat.com/errata/RHSA-2020:0727
Third Party Advisory vendor-advisory
https://usn.ubuntu.com/4308-1/
Third Party Advisory vendor-advisory
https://www.debian.org/security/2020/dsa-4669

Scores

CVSS v3 7.5
EPSS 0.0972
EPSS Percentile 93.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-770 CWE-400
Status published
Products (40)
apache/traffic_server 6.0.0 - 6.2.3
apple/swiftnio 1.0.0 - 1.4.0
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 19.04
debian/debian_linux 10.0
debian/debian_linux 9.0
f5/big-ip_local_traffic_manager 11.6.1 - 11.6.5.1
fedoraproject/fedora 29
fedoraproject/fedora 30
... and 30 more
Published Aug 13, 2019
Tracked Since Feb 18, 2026