CVE-2019-9518
Fixed in a distro release EPSS 25%CVSS 7.5
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
Products: apple swiftnio, apache traffic_server, canonical ubuntu_linux, debian_linux, synology skynas, synology diskstation_manager, synology vs960hd_firmware, fedoraproject fedora, opensuse leap, redhat jboss_core_services, redhat jboss_enterprise_application_platform, redhat openshift_service_mesh, redhat quay, redhat software_collections, redhat enterprise_linux, oracle graalvm, mcafee web_gateway, nodejs node.js
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2047+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2224+b07ac28e |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.4.0+2521+c668cc9f |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 |
| Alpine 3.10 | nodejs | 10.16.3-r0 |
| Alpine 3.11 | nodejs | 10.16.3-r0 |
| Alpine 3.12 | nodejs | 10.16.3-r0 |
| Alpine 3.13 | nodejs | 10.16.3-r0 |
| Alpine 3.14 | nodejs | 10.16.3-r0 |
| Alpine 3.15 | nodejs | 10.16.3-r0 |
| Alpine 3.16 | nodejs | 10.16.3-r0 |
| Alpine 3.17 | nodejs | 10.16.3-r0 |
| Alpine 3.18 | nodejs | 10.16.3-r0 |
| Alpine 3.19 | nodejs | 10.16.3-r0 |
| Alpine 3.20 | nodejs | 10.16.3-r0 |
| Alpine 3.21 | nodejs | 10.16.3-r0 |
| Alpine 3.22 | nodejs | 10.16.3-r0 |
| Alpine 3.23 | nodejs | 10.16.3-r0 |
| Alpine 3.24 | nodejs | 10.16.3-r0 |
| Alpine 3.9 | nodejs | 10.16.3-r0 |
| Debian 10 | trafficserver | 8.0.2+ds-1+deb10u1 |
| Debian 12 | trafficserver | 8.0.5+ds-1 |
| Red Hat Enterprise Linux 8 | nodejs | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-debuginfo | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-debugsource | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-devel | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-devel-debuginfo | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-docs | 1:10.16.3-2.module+el8.0.0+4214+49953fda |
| Red Hat Enterprise Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8+2632+6c5111ed |
| Red Hat Enterprise Linux 8 | nodejs-packaging | 0:17-3.module+el8+2873+aa7dfd9a |
| Red Hat Enterprise Linux 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda |
| Red Hat rhel software collections 3 | rh-nodejs10 | 0:3.2-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-debuginfo | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-devel | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-nodejs-docs | 0:10.16.3-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-npm | 0:6.9.0-10.16.3.3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-runtime | 0:3.2-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs10-scldevel | 0:3.2-3.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8 | 0:3.0-5.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs | 0:8.16.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-debuginfo | 0:8.16.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-devel | 0:8.16.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-nodejs-docs | 0:8.16.1-2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-npm | 0:6.4.1-8.16.1.2.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-runtime | 0:3.0-5.el7 |
| Red Hat rhel software collections 3 | rh-nodejs8-scldevel | 0:3.0-5.el7 |
| Rocky Linux 8 | nodejs-nodemon | 0:1.18.3-1.module+el8.3.0+101+f84c7154 |
| Rocky Linux 8 | nodejs-packaging | 0:17-3.module+el8.3.0+101+f84c7154 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs10 | 10.16.3-1.12.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | nodejs12 | 12.13.0-1.3.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | nodejs10 | 10.16.3-1.12.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 | nodejs8 | 8.16.1-3.20.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs10 | 10.16.3-1.12.1 |
| SUSE Linux Enterprise Module for Web and Scripting 15 SP1 | nodejs8 | 8.16.1-3.20.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 68.2.0-78.51.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 68-21.9.8 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 2.26.1-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 1.15.10-2.13.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 2.36.11-2.8.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 2.54.3-2.14.7 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 3.10.9-2.15.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 1.7.5-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 3.2.1.git259-2.3.3 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 1.40.14-2.7.4 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 4.21-29.6.1 |
| SUSE Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 3.45-38.9.3 |
| Ubuntu 18.04 LTS | trafficserver | no fix |
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 |
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 |