CVE-2019-9515 Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service
Attackers can cause denial of service by flooding HTTP/2 servers with SETTINGS frames, consuming excessive CPU and memory resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-9515?
CVE-2019-9515 is a high-severity denial of service vulnerability in Apache Traffic Server, published on 13 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Which versions are affected by CVE-2019-9515?
It affects 22 products.
Products include Apache Traffic Server, Apple Swiftnio, Canonical Ubuntu Linux, Debian Debian Linux, F5 Big-Ip Local Traffic Manager, Fedoraproject Fedora and 16 more.
How do I fix CVE-2019-9515?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-9515 being exploited?
There is no known exploitation of CVE-2019-9515 in the wild and no public exploit code.
Other vulnerabilities in Apache Traffic Server
Sources
Also known as ALPINE-CVE-2019-9515, CLEANSTART-2025-ST85629, CLEANSTART-2026-NL23465, CLEANSTART-2026-ST98216, CVE-2019-14991, DEBIAN-CVE-2019-9515 and 2 more.