CVE-2019-9511

NameCVE-2019-9511
DescriptionSome HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4505-1, DSA-4511-1, DSA-4669-1
Debian Bugs934885, 935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nghttp2 (PTS)jessie, jessie (lts)0.6.4-2+deb8u1fixed
stretch (security)1.18.1-1+deb9u2fixed
stretch (lts), stretch1.18.1-1+deb9u3fixed
buster1.36.0-2+deb10u1fixed
buster (security)1.36.0-2+deb10u2fixed
bullseye (security), bullseye1.43.0-1+deb11u1fixed
bookworm (security), bookworm1.52.0-1+deb12u1fixed
sid, trixie1.59.0-1fixed
nginx (PTS)jessie, jessie (lts)1.6.2-5+deb8u10fixed
stretch (security)1.10.3-1+deb9u7fixed
stretch (lts), stretch1.10.3-1+deb9u8fixed
buster1.14.2-2+deb10u4fixed
buster (security)1.14.2-2+deb10u5fixed
bullseye (security), bullseye1.18.0-6.1+deb11u3fixed
bookworm1.22.1-9fixed
sid, trixie1.24.0-2fixed
nodejs (PTS)jessie0.10.29~dfsg-2fixed
stretch4.8.2~dfsg-1fixed
buster10.24.0~dfsg-1~deb10u1fixed
buster (security)10.24.0~dfsg-1~deb10u4fixed
bullseye (security), bullseye12.22.12~dfsg-1~deb11u4fixed
bookworm18.13.0+dfsg1-1fixed
bookworm (security)18.19.0+dfsg-6~deb12u1fixed
trixie18.19.1+dfsg-3fixed
sid18.19.1+dfsg-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nghttp2sourcewheezy(unfixed)end-of-life
nghttp2sourcejessie(not affected)
nghttp2sourcestretch1.18.1-1+deb9u1DSA-4511-1
nghttp2sourcebuster1.36.0-2+deb10u1DSA-4511-1
nghttp2source(unstable)1.39.2-1
nginxsourcewheezy(unfixed)end-of-life
nginxsourcejessie(not affected)
nginxsourcestretch1.10.3-1+deb9u3DSA-4505-1
nginxsourcebuster1.14.2-2+deb10u1DSA-4505-1
nginxsource(unstable)1.14.2-3935037
nodejssourcejessie(not affected)
nodejssourcestretch(not affected)
nodejssourcebuster10.19.0~dfsg1-1DSA-4669-1
nodejssource(unstable)10.16.3~dfsg-1934885

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nghttp2 <not-affected> (Vulnerable code not present)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74089 (master)
https://github.com/nginx/nginx/commit/94c5eb142e58a86f81eb1369fa6fcb96c2f23d6b (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2

Search for package or bug name: Reporting problems