CVE-2019-9511
HighSome HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
Published Aug 13, 2019 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-9511, DEBIAN-CVE-2019-9511, DSA-4505-1, DSA-4511-1, SUSE-SU-2019:2254-1, SUSE-SU-2019:2259-1, SUSE-SU-2019:2260-1, SUSE-SU-2019:2473-1, SUSE-SU-2019:2559-1, UBUNTU-CVE-2019-9511, USN-4099-1, USN-6754-1
Key Facts
Patch immediately- CVE-2019-9511 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Traffic Server (Apache), Swiftnio (Apple), Nginx (F5) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 60% probability of exploitation in the next 30 days.
- Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, cmake 3.18.3-7.ph4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
60%
Higher than 99.1% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-9511 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Affected Products
519 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Traffic ServerApache | See advisory | 6.2.3 |
| SwiftnioApple | See advisory | 1.4.0 |
| NginxF5 | See advisory | 1.16.1 |
| Web GatewayMcafee | See advisory | 7.7.2.24 |
| Node.jsNodejs | See advisory | 8.8.1 |
Patched Releases
Traffic Server
<=6.2.3
Swiftnio
<=1.4.0
cmake
3.18.3-7.ph4, 3.25.2-4.ph5
eap7-apache-commons-beanutils
0:1.9.4-1.redhat_00002.1.ep7.el7
eap7-apache-cxf
0:3.2.10-1.redhat_00001.1.el6eap, 0:3.2.10-1.redhat_00001.1.el7eap, 0:3.2.10-1.redhat_00001.1.el8eap
eap7-byte-buddy
0:1.9.11-1.redhat_00002.1.el6eap, 0:1.9.11-1.redhat_00002.1.el7eap, 0:1.9.11-1.redhat_00002.1.el8eap
eap7-glassfish-jsf
0:2.3.5-5.SP3_redhat_00003.1.el6eap, 0:2.3.5-5.SP3_redhat_00003.1.el7eap, 0:2.3.5-5.SP3_redhat_00003.1.el8eap
eap7-hal-console
0:3.0.17-2.Final_redhat_00001.1.el6eap, 0:3.0.17-2.Final_redhat_00001.1.el7eap, 0:3.0.17-2.Final_redhat_00001.1.el8eap
eap7-hibernate
0:5.3.13-1.Final_redhat_00001.1.el6eap, 0:5.3.13-1.Final_redhat_00001.1.el7eap, 0:5.3.13-1.Final_redhat_00001.1.el8eap
eap7-infinispan
0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
eap7-ironjacamar
0:1.4.18-1.Final_redhat_00001.1.el6eap, 0:1.4.18-1.Final_redhat_00001.1.el7eap, 0:1.4.18-1.Final_redhat_00001.1.el8eap
eap7-jackson-databind
0:2.8.11.5-1.redhat_00001.1.ep7.el7
eap7-jboss-genericjms
0:2.0.2-1.Final_redhat_00001.1.el6eap, 0:2.0.2-1.Final_redhat_00001.1.el7eap, 0:2.0.2-1.Final_redhat_00001.1.el8eap
eap7-jboss-msc
0:1.4.11-1.Final_redhat_00001.1.el6eap, 0:1.4.11-1.Final_redhat_00001.1.el7eap, 0:1.4.11-1.Final_redhat_00001.1.el8eap
eap7-jboss-remoting
0:5.0.16-2.Final_redhat_00001.1.el6eap, 0:5.0.16-2.Final_redhat_00001.1.el7eap, 0:5.0.16-2.Final_redhat_00001.1.el8eap
eap7-jboss-server-migration
0:1.3.1-6.Final_redhat_00006.1.el6eap, 0:1.3.1-6.Final_redhat_00006.1.el7eap, 0:1.3.1-6.Final_redhat_00006.1.el8eap
eap7-jboss-xnio-base
0:3.7.6-2.SP1_redhat_00001.1.el6eap, 0:3.7.6-2.SP1_redhat_00001.1.el7eap, 0:3.7.6-2.SP1_redhat_00001.1.el8eap
eap7-log4j-jboss-logmanager
0:1.2.2-1.Final_redhat_00002.1.ep7.el7
eap7-netty
0:4.1.45-1.Final_redhat_00001.1.ep7.el7
eap7-picketbox
0:5.0.3-6.Final_redhat_00005.1.el6eap, 0:5.0.3-6.Final_redhat_00005.1.el7eap, 0:5.0.3-6.Final_redhat_00005.1.el8eap
eap7-picketlink-bindings
0:2.5.5-20.SP12_redhat_00009.1.el6eap, 0:2.5.5-20.SP12_redhat_00009.1.el7eap, 0:2.5.5-20.SP12_redhat_00009.1.el8eap
eap7-picketlink-federation
0:2.5.5-20.SP12_redhat_00009.1.el6eap, 0:2.5.5-20.SP12_redhat_00009.1.el7eap, 0:2.5.5-20.SP12_redhat_00009.1.el8eap
eap7-resteasy
0:3.6.1-7.SP7_redhat_00001.1.el6eap, 0:3.6.1-7.SP7_redhat_00001.1.el7eap, 0:3.6.1-7.SP7_redhat_00001.1.el8eap
eap7-undertow
0:1.4.18-12.SP12_redhat_00001.1.ep7.el7, 0:2.0.26-2.SP3_redhat_00001.1.el6eap, 0:2.0.26-2.SP3_redhat_00001.1.el8eap
eap7-wildfly
0:7.2.5-4.GA_redhat_00002.1.el6eap, 0:7.2.5-4.GA_redhat_00002.1.el7eap, 0:7.2.5-4.GA_redhat_00002.1.el8eap
Timeline
Publicly disclosed
Aug 13, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- advisoryopenSUSE-SU-2019:2115
- advisoryopenSUSE-SU-2019:2114
- advisoryopenSUSE-SU-2019:2120
- advisoryopenSUSE-SU-2019:2232
- advisoryopenSUSE-SU-2019:2234
FAQ
Common Questions.
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.
Affected: Traffic Server (Apache); Swiftnio (Apple); Nginx (F5), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, cmake 3.18.3-7.ph4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-9511 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo