CVE-2019-9511

Name	CVE-2019-9511
Description	Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4505-1, DSA-4511-1, DSA-4669-1
Debian Bugs	934885, 935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nghttp2 (PTS)	jessie, jessie (lts)	0.6.4-2+deb8u1	fixed
	stretch (security)	1.18.1-1+deb9u2	fixed
	stretch (lts), stretch	1.18.1-1+deb9u4	fixed
	buster (security), buster, buster (lts)	1.36.0-2+deb10u3	fixed
	bullseye (security), bullseye	1.43.0-1+deb11u1	fixed
	bookworm (security), bookworm	1.52.0-1+deb12u1	fixed
	sid, trixie	1.63.0-1	fixed
nginx (PTS)	jessie, jessie (lts)	1.6.2-5+deb8u10	fixed
	stretch (security)	1.10.3-1+deb9u7	fixed
	stretch (lts), stretch	1.10.3-1+deb9u8	fixed
	buster (security), buster, buster (lts)	1.14.2-2+deb10u5	fixed
	bullseye (security), bullseye	1.18.0-6.1+deb11u3	fixed
	bookworm	1.22.1-9	fixed
	sid, trixie	1.26.0-2	fixed
nodejs (PTS)	jessie	0.10.29~dfsg-2	fixed
	stretch	4.8.2~dfsg-1	fixed
	buster (security), buster, buster (lts)	10.24.0~dfsg-1~deb10u4	fixed
	bullseye	12.22.12~dfsg-1~deb11u4	fixed
	bullseye (security)	12.22.12~dfsg-1~deb11u5	fixed
	bookworm	18.19.0+dfsg-6~deb12u2	fixed
	bookworm (security)	18.19.0+dfsg-6~deb12u1	fixed
	sid, trixie	20.17.0+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nghttp2	source	wheezy	(unfixed)	end-of-life
nghttp2	source	jessie	(not affected)
nghttp2	source	stretch	1.18.1-1+deb9u1		DSA-4511-1
nghttp2	source	buster	1.36.0-2+deb10u1		DSA-4511-1
nghttp2	source	(unstable)	1.39.2-1
nginx	source	wheezy	(unfixed)	end-of-life
nginx	source	jessie	(not affected)
nginx	source	stretch	1.10.3-1+deb9u3		DSA-4505-1
nginx	source	buster	1.14.2-2+deb10u1		DSA-4505-1
nginx	source	(unstable)	1.14.2-3			935037
nodejs	source	jessie	(not affected)
nodejs	source	stretch	(not affected)
nodejs	source	buster	10.19.0~dfsg1-1		DSA-4669-1
nodejs	source	(unstable)	10.16.3~dfsg-1			934885

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nghttp2 <not-affected> (Vulnerable code not present)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74089 (master)
https://github.com/nginx/nginx/commit/94c5eb142e58a86f81eb1369fa6fcb96c2f23d6b (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2