Which products and versions are affected by CVE-2019-9516?

Affected: Traffic Server (Apache); Swiftnio (Apple); Nginx (F5), among others. The full list is in the CVE brief.

Is CVE-2019-9516 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2019-9516 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2019-9516?

No public exploit code is known.

Is there a fix for CVE-2019-9516?

Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, Nginx 1.16.1.

How urgently should CVE-2019-9516 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2019-9516

Q: What is CVE-2019-9516?

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Q: How urgently should CVE-2019-9516 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Medium

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.

Published Aug 13, 2019 · Updated Aug 4, 2026 · Also known as ALPINE-CVE-2019-9516, DEBIAN-CVE-2019-9516, UBUNTU-CVE-2019-9516

Key Facts

Patch immediately

CVE-2019-9516 is a medium-severity vulnerability (CVSS 6.5 v3.1) affecting Traffic Server (Apache), Swiftnio (Apple), Nginx (F5) and 22 more products.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 56% probability of exploitation in the next 30 days.
Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, Nginx 1.16.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS (30-day exploit likelihood)

56%

Higher than 99.0% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2019-9516 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Affected Products

269 affected entries in total

Product	Affected versions	Fixed in
Traffic ServerApache	See advisory	6.2.3
SwiftnioApple	See advisory	1.4.0
NginxF5	See advisory	1.16.1
Web GatewayMcafee	See advisory	7.7.2.24
Node.jsNodejs	See advisory	12.8.1

20 more affected products in the full CVE brief

Patched Releases

Traffic Server

<=6.2.3

Swiftnio

<=1.4.0

Nginx

1.16.1, 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e, 1:1.14.1-9.module_el8.4.0+2221+af250afe.alma, 1:1.14.1-9.module+el8.4.0+542+81547229, 1:1.16.1-1.37.amzn1, 1.10.3-0ubuntu0.16.04.4, 1.10.3-1+deb9u3, 1.14.0-0ubuntu1.4, 1.14.1-r1, 1.14.1-r2, 1.14.2-2+deb10u1, 1.14.2-3, 1.14.2-3.6.1, 1.14.2-6.3.1, 1.14.2-lp150.2.11.1, 1.14.2-lp151.4.3.1, 1.16.1-1, 1.16.1-r0, 1.20.1-1, 1.21.3-1.4, NA

firefox-atk

2.26.1-2.8.4

firefox-atk-lang

2.26.1-2.8.4

firefox-cairo

1.15.10-2.13.4

firefox-gdk-pixbuf

2.36.11-2.8.4

firefox-gdk-pixbuf-lang

2.36.11-2.8.4

firefox-gdk-pixbuf-query-loaders

2.36.11-2.8.4

firefox-gdk-pixbuf-thumbnailer

2.36.11-2.8.4

firefox-gio-branding-upstream

2.54.3-2.14.7

firefox-glib2

2.54.3-2.14.7

firefox-glib2-lang

2.54.3-2.14.7

firefox-glib2-tools

2.54.3-2.14.7

firefox-gtk3

3.10.9-2.15.3

firefox-gtk3-branding-upstream

3.10.9-2.15.3

firefox-gtk3-data

3.10.9-2.15.3

firefox-gtk3-immodule-amharic

3.10.9-2.15.3

firefox-gtk3-immodule-inuktitut

3.10.9-2.15.3

firefox-gtk3-immodule-multipress

3.10.9-2.15.3

firefox-gtk3-immodule-thai

3.10.9-2.15.3

firefox-gtk3-immodule-vietnamese

3.10.9-2.15.3

firefox-gtk3-immodule-xim

3.10.9-2.15.3

firefox-gtk3-immodules-tigrigna

3.10.9-2.15.3

firefox-gtk3-lang

3.10.9-2.15.3

Timeline

Publicly disclosed
Aug 13, 2019
Last updated
Aug 4, 2026

Weakness Type

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling

References

15 more references in the full CVE brief

FAQ

Common Questions.

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.
Affected: Traffic Server (Apache); Swiftnio (Apple); Nginx (F5), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Traffic Server <=6.2.3, Swiftnio <=1.4.0, Nginx 1.16.1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2019-9516 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo