CVE-2019-9511

Source
https://nvd.nist.gov/vuln/detail/CVE-2019-9511
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-9511.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-9511
Downstream
Related
Published
2019-08-13T21:15:12Z
Modified
2025-09-30T02:32:09.530228Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

References

Affected packages

Git / github.com/nginx/nginx

Affected ranges

Type
GIT
Repo
https://github.com/nginx/nginx
Events
Type
GIT
Repo
https://github.com/nodejs/node
Events

Affected versions

release-1.*

release-1.11.0
release-1.11.1
release-1.11.10
release-1.11.11
release-1.11.12
release-1.11.13
release-1.11.2
release-1.11.3
release-1.11.4
release-1.11.5
release-1.11.6
release-1.11.7
release-1.11.8
release-1.11.9
release-1.13.0
release-1.13.1
release-1.13.10
release-1.13.11
release-1.13.12
release-1.13.2
release-1.13.3
release-1.13.4
release-1.13.5
release-1.13.6
release-1.13.7
release-1.13.8
release-1.13.9
release-1.15.0
release-1.15.1
release-1.15.10
release-1.15.11
release-1.15.12
release-1.15.2
release-1.15.3
release-1.15.4
release-1.15.5
release-1.15.6
release-1.15.7
release-1.15.8
release-1.15.9
release-1.16.0
release-1.9.10
release-1.9.11
release-1.9.12
release-1.9.13
release-1.9.14
release-1.9.15
release-1.9.5
release-1.9.6
release-1.9.7
release-1.9.8
release-1.9.9

v8.*

v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4