Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service
Description
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Categories
The product does not properly control the allocation and maintenance of a limited resource.
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
7.5
CVSS
Severity: High
CVSS 3.1 •
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0 •
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 •
AV:N/AC:L/Au:N/C:N/I:N/A:C
EPSS
Probability of exploitation activity in the next 30 days.
CVE-2019-9514 has been scored as a high severity vulnerability.
How to fix CVE-2019-9514?
To fix CVE-2019-9514, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-9514 being actively exploited in the wild?
It is possible that CVE-2019-9514 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~12% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.