CVE-2019-9515
HighSome HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
Published Aug 13, 2019 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-9515, DEBIAN-CVE-2019-9515, UBUNTU-CVE-2019-9515
Key Facts
Patch immediately- CVE-2019-9515 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Traffic Server (Apache), Swiftnio (Apple), Big-Ip Local Traffic Manager (F5) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 87% probability of exploitation in the next 30 days.
- Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, containerd 1.2.9-r0.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (30-day exploit likelihood)
87%
Higher than 99.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2019-9515 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Affected Products
338 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Traffic ServerApache | See advisory | 6.2.3 |
| SwiftnioApple | See advisory | 1.4.0 |
| Big-Ip Local Traffic ManagerF5 | See advisory | 11.6.5.1 |
| Web GatewayMcafee | See advisory | 7.7.2.24 |
| Node.jsNodejs | See advisory | 8.8.1 |
Patched Releases
Traffic Server
<=6.2.3
Swiftnio
<=1.4.0
containerd
1.2.9-r0
eap7-apache-commons-beanutils
0:1.9.4-1.redhat_00002.1.ep7.el7
eap7-apache-cxf
0:3.2.10-1.redhat_00001.1.el6eap, 0:3.2.10-1.redhat_00001.1.el7eap, 0:3.2.10-1.redhat_00001.1.el8eap
eap7-byte-buddy
0:1.9.11-1.redhat_00002.1.el6eap, 0:1.9.11-1.redhat_00002.1.el7eap, 0:1.9.11-1.redhat_00002.1.el8eap
eap7-glassfish-jsf
0:2.3.5-5.SP3_redhat_00003.1.el6eap, 0:2.3.5-5.SP3_redhat_00003.1.el7eap, 0:2.3.5-5.SP3_redhat_00003.1.el8eap
eap7-hal-console
0:3.0.17-2.Final_redhat_00001.1.el6eap, 0:3.0.17-2.Final_redhat_00001.1.el7eap, 0:3.0.17-2.Final_redhat_00001.1.el8eap
eap7-hibernate
0:5.3.13-1.Final_redhat_00001.1.el6eap, 0:5.3.13-1.Final_redhat_00001.1.el7eap, 0:5.3.13-1.Final_redhat_00001.1.el8eap
eap7-infinispan
0:8.2.11-1.SP2_redhat_00001.1.ep7.el7
eap7-ironjacamar
0:1.4.18-1.Final_redhat_00001.1.el6eap, 0:1.4.18-1.Final_redhat_00001.1.el7eap, 0:1.4.18-1.Final_redhat_00001.1.el8eap
eap7-jackson-databind
0:2.8.11.5-1.redhat_00001.1.ep7.el7
eap7-jboss-genericjms
0:2.0.2-1.Final_redhat_00001.1.el6eap, 0:2.0.2-1.Final_redhat_00001.1.el7eap, 0:2.0.2-1.Final_redhat_00001.1.el8eap
eap7-jboss-msc
0:1.4.11-1.Final_redhat_00001.1.el6eap, 0:1.4.11-1.Final_redhat_00001.1.el7eap, 0:1.4.11-1.Final_redhat_00001.1.el8eap
eap7-jboss-remoting
0:5.0.16-2.Final_redhat_00001.1.el6eap, 0:5.0.16-2.Final_redhat_00001.1.el7eap, 0:5.0.16-2.Final_redhat_00001.1.el8eap
eap7-jboss-server-migration
0:1.3.1-6.Final_redhat_00006.1.el6eap, 0:1.3.1-6.Final_redhat_00006.1.el7eap, 0:1.3.1-6.Final_redhat_00006.1.el8eap
eap7-jboss-xnio-base
0:3.7.6-2.SP1_redhat_00001.1.el6eap, 0:3.7.6-2.SP1_redhat_00001.1.el7eap, 0:3.7.6-2.SP1_redhat_00001.1.el8eap
eap7-log4j-jboss-logmanager
0:1.2.2-1.Final_redhat_00002.1.ep7.el7
eap7-netty
0:4.1.45-1.Final_redhat_00001.1.ep7.el7
eap7-picketbox
0:5.0.3-6.Final_redhat_00005.1.el6eap, 0:5.0.3-6.Final_redhat_00005.1.el7eap, 0:5.0.3-6.Final_redhat_00005.1.el8eap
eap7-picketlink-bindings
0:2.5.5-20.SP12_redhat_00009.1.el6eap, 0:2.5.5-20.SP12_redhat_00009.1.el7eap, 0:2.5.5-20.SP12_redhat_00009.1.el8eap
eap7-picketlink-federation
0:2.5.5-20.SP12_redhat_00009.1.el6eap, 0:2.5.5-20.SP12_redhat_00009.1.el7eap, 0:2.5.5-20.SP12_redhat_00009.1.el8eap
eap7-resteasy
0:3.6.1-7.SP7_redhat_00001.1.el6eap, 0:3.6.1-7.SP7_redhat_00001.1.el7eap, 0:3.6.1-7.SP7_redhat_00001.1.el8eap
eap7-undertow
0:1.4.18-12.SP12_redhat_00001.1.ep7.el7, 0:2.0.26-2.SP3_redhat_00001.1.el6eap, 0:2.0.26-2.SP3_redhat_00001.1.el8eap
eap7-wildfly
0:7.2.5-4.GA_redhat_00002.1.el6eap, 0:7.2.5-4.GA_redhat_00002.1.el7eap, 0:7.2.5-4.GA_redhat_00002.1.el8eap
Timeline
Publicly disclosed
Aug 13, 2019
Last updated
Aug 4, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-770 Allocation of Resources Without Limits or Throttling
References
- advisoryhttp://blog.kazuhooku.com/2019/08/h2o-version-226-230-beta2-released.html
- advisoryopenSUSE-SU-2019:2115
- advisoryopenSUSE-SU-2019:2114
- advisoryRHSA-2019:2766
- advisoryRHSA-2019:2796
FAQ
Common Questions.
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.
Affected: Traffic Server (Apache); Swiftnio (Apple); Big-Ip Local Traffic Manager (F5), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, containerd 1.2.9-r0.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2019-9515 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo