Resource exhaustion in Apache Traffic Server
CVE-2019-9511
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.595 (99.1th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.595 · newest: 0.595 · change: 0.000
Affected products
- Apache Traffic Server
- Apple Mac OS X
- Apple Swiftnio
- F5 nginx
- Mcafee Web Gateway
- Node.js
- Oracle Enterprise Communications Broker — versions 3.1.0, 3.2.0
- Oracle Graalvm — versions 19.2.0
- Synology Diskstation Manager — versions 6.2
- Synology Skynas
Weakness classification (CWE)
Public proof-of-concept exploits
- flyniu666/ingress-nginx-0.21-1.19.5
- harley-ghostie/CVE-2019-9511_Priority-Churn-Data-Dribble
- ChiomaDibor/Vulnerability-Management-of-a-Web-Server-Using-Nessus-and-Patch-Management-with-Ansible
- Cybervixy/Vulnerability-Management
- Deeoojo/Vulnerability-Management-Nessus-Ansible-
- Dorakhris/Vulnerability-Assessment-lab
- Eldor240/files
- Oju-kwu/Vulnerability-Management-Lab
- Teedico/Nessus_
- Trynityneo/VulScannerKali
References
- kb.cert.org/vuls/id/605641/ (US Government Resource, Third Party Advisory, third-party-advisory)
- usn.ubuntu.com/4099-1/ (vendor-advisory, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- seclists.org/bugtraq/2019/Aug/40 (mailing-list, Mailing List, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- www.debian.org/security/2019/dsa-4505 (vendor-advisory, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- seclists.org/bugtraq/2019/Sep/1 (mailing-list, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-9511?
- CVE-2019-9511 is a high-severity vulnerability in Apache Traffic Server, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2019-08-13.
- How severe is CVE-2019-9511?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-9511 known to be exploited?
- 17 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.