CVE-2019-9517 Denial of service in n/a

High 7.5 Published 13 Aug 2019 Updated 4 Aug 2024

Attackers can cause denial of service in HTTP/2 servers by exploiting unconstrained internal data buffering via manipulated TCP and HTTP/2 windows.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-9517?

CVE-2019-9517 is a high-severity denial of service vulnerability in Apache Http Server, published on 13 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Weakness: CWE-770, CWE-400

Which versions are affected by CVE-2019-9517?

It affects 23 products.

Linux distribution packages (21)

`httpd` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-devel` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-filesystem` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-manual` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-tools` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`httpd-tools-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_http2` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.11.3-3.module+el8.0.0+4096+eb40e6da`
`mod_http2-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.11.3-3.module+el8.0.0+4096+eb40e6da`
`mod_http2-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:1.11.3-3.module+el8.0.0+4096+eb40e6da`
`mod_ldap` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_ldap-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_md` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_md-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_proxy_html` Red Hat:enterprise_linux:8::appstream	All versions	`1:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_proxy_html-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`1:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_session` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_session-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_ssl` Red Hat:enterprise_linux:8::appstream	All versions	`1:2.4.37-12.module+el8.0.0+4096+eb40e6da`
`mod_ssl-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`1:2.4.37-12.module+el8.0.0+4096+eb40e6da`

Products include Apache Http Server, Apache Traffic Server, Apple Swiftnio, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora and 17 more.

How do I fix CVE-2019-9517?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-9517 being exploited?

There is no known exploitation of CVE-2019-9517 in the wild and no public exploit code.

All Apache Http Server vulnerabilities

Sources

Also known as ALPINE-CVE-2019-9517, CLEANSTART-2026-VK65361, CLEANSTART-2026-XC13093, CLEANSTART-2026-XM65075, DEBIAN-CVE-2019-9517, GHSA-w6v5-q8c8-52xx and 2 more.