CVE-2019-9513
HighSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
Published Aug 13, 2019 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-9513, DEBIAN-CVE-2019-9513, UBUNTU-CVE-2019-9513
Key Facts
Patch immediately- CVE-2019-9513 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Traffic Server (Apache), Swiftnio (Apple), Nginx (F5) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 82% probability of exploitation in the next 30 days.
- Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, cmake 3.18.3-7.ph4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
82%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-9513 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Affected Products
423 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Traffic ServerApache | See advisory | 6.2.3 |
| SwiftnioApple | See advisory | 1.4.0 |
| NginxF5 | See advisory | 1.16.1 |
| Web GatewayMcafee | See advisory | 7.7.2.24 |
| Node.jsNodejs | See advisory | 8.8.1 |
Patched Releases
Traffic Server
<=6.2.3
Swiftnio
<=1.4.0
cmake
3.18.3-7.ph4, 3.25.2-4.ph5
Nginx
1.16.1, 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e, 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma, 1:1.14.1-9.module+el8.4.0+542+81547229, 1:1.16.1-1.37.amzn1, 1.10.3-0ubuntu0.16.04.4, 1.10.3-1+deb9u3, 1.14.0-0ubuntu1.4, 1.14.1-r1, 1.14.1-r2, 1.14.2-2+deb10u1, 1.14.2-3, 1.14.2-3.6.1, 1.14.2-6.3.1, 1.14.2-lp150.2.11.1, 1.14.2-lp151.4.3.1, 1.16.1-1, 1.16.1-r0, 1.20.1-1, 1.22.0-4.ph4, NA
firefox-atk
2.26.1-2.8.4
firefox-atk-lang
2.26.1-2.8.4
firefox-cairo
1.15.10-2.13.4
firefox-gdk-pixbuf
2.36.11-2.8.4
firefox-gdk-pixbuf-lang
2.36.11-2.8.4
firefox-gdk-pixbuf-query-loaders
2.36.11-2.8.4
firefox-gdk-pixbuf-thumbnailer
2.36.11-2.8.4
firefox-gio-branding-upstream
2.54.3-2.14.7
firefox-glib2
2.54.3-2.14.7
firefox-glib2-lang
2.54.3-2.14.7
firefox-glib2-tools
2.54.3-2.14.7
firefox-gtk3
3.10.9-2.15.3
firefox-gtk3-branding-upstream
3.10.9-2.15.3
firefox-gtk3-data
3.10.9-2.15.3
firefox-gtk3-immodule-amharic
3.10.9-2.15.3
firefox-gtk3-immodule-inuktitut
3.10.9-2.15.3
firefox-gtk3-immodule-multipress
3.10.9-2.15.3
firefox-gtk3-immodule-thai
3.10.9-2.15.3
firefox-gtk3-immodule-vietnamese
3.10.9-2.15.3
firefox-gtk3-immodule-xim
3.10.9-2.15.3
firefox-gtk3-immodules-tigrigna
3.10.9-2.15.3
Timeline
Publicly disclosed
Aug 13, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
References
- advisoryopenSUSE-SU-2019:2115
- advisoryopenSUSE-SU-2019:2114
- advisoryopenSUSE-SU-2019:2120
- advisoryopenSUSE-SU-2019:2232
- advisoryopenSUSE-SU-2019:2234
FAQ
Common Questions.
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
Affected: Traffic Server (Apache); Swiftnio (Apple); Nginx (F5), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, cmake 3.18.3-7.ph4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-9513 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo