PT-2019-3464 · Apple+9 · Swiftnio+9
Jonathan Looney
·
Published
2019-08-13
·
Updated
2026-05-18
·
CVE-2019-9516
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
nginx (affected versions not specified)
Node.js (affected versions not specified)
SwiftNIO (affected versions not specified)
Description
The issue is related to an uncontrolled resource consumption when receiving a header with a length parameter set to zero in HTTP/2 implementations. This can lead to a denial of service. An attacker can exploit this by sending a stream of headers with 0-length header names and 0-length header values, which can cause excess memory consumption as some implementations allocate memory for these headers and keep it alive until the session ends.
Recommendations
For nginx, consider restricting or disabling HTTP/2 support until a patch is available.
For Node.js, avoid using HTTP/2 implementations that allocate memory for 0-length headers until a fix is provided.
For SwiftNIO, as a temporary workaround, consider disabling the HTTP/2 protocol to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
Resource Exhaustion
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Nginx
Node.Js
Red Hat
Rocky Linux
Suse
Swiftnio
Ubuntu