PT-2019-3015 · Node.Js Foundation+11 · Node.Js+11
Jonathan Looney
·
Published
2019-03-20
·
Updated
2026-05-18
·
CVE-2019-9511
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
HTTP/2 implementations (affected versions not specified)
nginx (affected versions not specified)
Node.js (affected versions not specified)
Apache HTTP Server (affected versions not specified)
Windows (affected versions not specified)
Description
The issue is related to window size manipulation and stream prioritization manipulation in HTTP/2 implementations, potentially leading to a denial of service. An attacker can request a large amount of data from a specified resource over multiple streams, manipulating window size and stream priority to force the server to queue the data in 1-byte chunks. This can consume excess CPU, memory, or both, depending on how efficiently the data is queued.
Recommendations
For HTTP/2 implementations, consider disabling the HTTP/2 protocol until a patch is available.
For nginx, restrict access to the HTTP/2 module to minimize the risk of exploitation.
For Node.js, avoid using the HTTP/2 module in production environments until the issue is resolved.
For Apache HTTP Server, consider disabling the HTTP/2 protocol or restricting access to the affected module to minimize the risk of exploitation.
For Windows, apply configuration changes to restrict the use of HTTP/2 or disable it temporarily until a fix is available.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Apache Http Server
Centos
Linuxmint
Nginx
Node.Js
Red Hat
Rocky Linux
Suse
Ubuntu
Windows