Resource exhaustion in Apache Traffic Server
CVE-2019-9514
Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.828 (99.7th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 100th percentile — 99.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.828 · newest: 0.828 · change: 0.000
Affected products
Weakness classification (CWE)
Public proof-of-concept exploits
References
- kb.cert.org/vuls/id/605641/ (US Government Resource, Third Party Advisory, third-party-advisory)
- github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-0… (Third Party Advisory)
- lists.apache.org/thread.html/bde52309316ae798186d783a5e29f4ad1527f61c9219a289d0… (mailing-list)
- lists.apache.org/thread.html/392108390cef48af647a2e47b7fd5380e050e35ae8d1aa2030… (mailing-list)
- lists.apache.org/thread.html/ad3d01e767199c1aed8033bb6b3f5bf98c011c7c536f07a5d3… (mailing-list)
- seclists.org/bugtraq/2019/Aug/24 (mailing-list, Mailing List, Third Party Advisory)
- seclists.org/fulldisclosure/2019/Aug/16 (mailing-list, Mailing List, Third Party Advisory)
- www.synology.com/security/advisory/Synology_SA_19_33 (Third Party Advisory)
- seclists.org/bugtraq/2019/Aug/31 (mailing-list, Mailing List, Third Party Advisory)
- www.debian.org/security/2019/dsa-4503 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-9514?
- CVE-2019-9514 is a high-severity vulnerability in Apache Traffic Server, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2019-08-13.
- How severe is CVE-2019-9514?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2019-9514 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.