Description
Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nghttp2 | 1.39.2-1 | — |
| Debian 14 | nginx | 1.14.2-3 | — |
| Debian 14 | nodejs | 10.16.3~dfsg-1 | — |
| Debian 13 | nghttp2 | 1.39.2-1 | — |
| Debian 13 | nginx | 1.14.2-3 | — |
| Debian 13 | nodejs | 10.16.3~dfsg-1 | — |
| Debian 12 | nghttp2 | 1.39.2-1 | — |
| Debian 12 | nginx | 1.14.2-3 | — |
| Debian 12 | nodejs | 10.16.3~dfsg-1 | — |
| Debian 10 | nghttp2 | 1.36.0-2+deb10u1 | DSA-4511-1 |
| Debian 10 | nginx | 1.14.2-2+deb10u1 | DSA-4505-1 |
| Debian 10 | nodejs | 10.19.0~dfsg1-1 | DSA-4669-1 |
| Debian 9 | nghttp2 | 1.18.1-1+deb9u1 | DSA-4511-1 |
| Debian 9 | nginx | 1.10.3-1+deb9u3 | DSA-4505-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | nghttp2 | 1.43.0-1ubuntu0.2 | USN-6754-1 |
| Ubuntu 20.04 LTS | nghttp2 | 1.40.0-1ubuntu0.3 | USN-6754-1 |
| Ubuntu 18.04 LTS | nginx | 1.14.0-0ubuntu1.4 | USN-4099-1 |
| Ubuntu 16.04 LTS | nginx | 1.10.3-0ubuntu0.16.04.4 | USN-4099-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | nghttp2 | 1.30.0-1ubuntu1+esm2 | USN-6754-1 |
| Ubuntu Pro 18.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 16.04 LTS | nghttp2 | 1.7.1-1ubuntu0.1~esm2 | USN-6754-1 |
| Ubuntu Pro 16.04 LTS | nodejs | No fix yet | — |
| Ubuntu Pro 14.04 LTS | nodejs | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nghttp2 +2 | 1.33.0-1.el8_0.1 | RHSA-2019:2692 |
| RHEL 8 | nginx +7 | 1:1.14.1-9.module+el8.0.0+4108+af250afe | RHSA-2019:2799 |
| RHEL 8 | nodejs +2 | 1:10.16.3-2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2019:2925 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2019:2925 |
| RHEL 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 3 | httpd24-httpd +5 | 2.4.34-8.el6.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-mod_md | 2.4.34-8.el7.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-mod_ssl +1 | 1:2.4.34-8.el6.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-nghttp2 +2 | 1.7.1-7.el6.1 | RHSA-2019:2949 |
| RHEL 3 | rh-nginx110-nginx +5 | 1:1.10.2-9.el6.1 | RHSA-2019:2745 |
| RHEL 3 | rh-nginx112-nginx +5 | 1:1.12.1-3.el7.1 | RHSA-2019:2746 |
| RHEL 3 | rh-nginx114-nginx +5 | 1:1.14.1-1.el7.1 | RHSA-2019:2775 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8 +2 | 3.0-5.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.1-2.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.1.2.el7 | RHSA-2019:2955 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 1 | kiali | v1.0.6.redhat1-1.el7 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh +10 | 1.0.1-8.el8 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh-grafana +1 | 6.2.2-21.el8 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh-prometheus | 2.7.2-22.el8 | RHSA-2019:3041 |
| Red Hat Service Mesh 1 | servicemesh-proxy | 1.0.1-7.el8 | RHSA-2019:3041 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr +1 | 1.6.3-63.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr-util +8 | 1.6.1-48.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-brotli +1 | 1.0.6-7.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 7.64.1-14.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-jansson +1 | 2.11-20.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.12-9.Final_redhat_2.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +2 | 1.2.46-22.redhat_1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 2.4.37-33.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.2-16.GA.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.39.2-1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1-25.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nginx +7 | 1:1.14.1-9.module_el8.3.0+2165+af250afe.alma | ALSA-2019:2799 |
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nginx | 1:1.14.1-9.module+el8.4.0+542+81547229 | RLSA-2019:2799 |
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nghttp2 | 1.39.2-3.3.1 | SUSE-SU-2019:2473-1 |
| SLES 15 SP1 | nginx | 1.14.2-6.3.1 | SUSE-SU-2019:2309-1 |
| SLES 15 SP1 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 SP1 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 15 | nghttp2 | 1.39.2-3.3.1 | SUSE-SU-2019:2473-1 |
| SLES 15 | nginx | 1.14.2-3.6.1 | SUSE-SU-2019:2559-1 |
| SLES 15 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 12 SP5 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP4 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP3 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP2 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2254-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
| SLES for SAP 12 SP5 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP4 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP3 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP2 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud Crowbar 9 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud Crowbar 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 9 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 7 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE HPE Helion OpenStack 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | nghttp2 +1 | 1.39.2-lp151.3.3.1 | openSUSE-SU-2019:2232-1 |
| openSUSE Leap 15.1 | nginx | 1.14.2-lp151.4.3.1 | openSUSE-SU-2019:2120-1 |
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
| openSUSE Leap 15.0 | nghttp2 +1 | 1.39.2-lp150.2.3.1 | openSUSE-SU-2019:2234-1 |
| openSUSE Leap 15.0 | nginx | 1.14.2-lp150.2.11.1 | openSUSE-SU-2019:2264-1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.24 | nginx | 1.16.1-r0 | — |
| Alpine v3.24 | nodejs | 10.16.3-r0 | — |
| Alpine v3.23 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.23 | nginx | 1.16.1-r0 | — |
| Alpine v3.23 | nodejs | 10.16.3-r0 | — |
| Alpine v3.22 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.22 | nginx | 1.16.1-r0 | — |
| Alpine v3.22 | nodejs | 10.16.3-r0 | — |
| Alpine v3.21 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.21 | nginx | 1.16.1-r0 | — |
| Alpine v3.21 | nodejs | 10.16.3-r0 | — |
| Alpine v3.20 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.20 | nginx | 1.16.1-r0 | — |
| Alpine v3.20 | nodejs | 10.16.3-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.19 | nginx | 1.16.1-r0 | — |
| Alpine v3.19 | nodejs | 10.16.3-r0 | — |
| Alpine v3.18 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.18 | nginx | 1.16.1-r0 | — |
| Alpine v3.18 | nodejs | 10.16.3-r0 | — |
| Alpine v3.17 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.17 | nginx | 1.16.1-r0 | — |
| Alpine v3.17 | nodejs | 10.16.3-r0 | — |
| Alpine v3.16 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.16 | nginx | 1.16.1-r0 | — |
| Alpine v3.16 | nodejs | 10.16.3-r0 | — |
| Alpine v3.15 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.15 | nginx | 1.16.1-r0 | — |
| Alpine v3.15 | nodejs | 10.16.3-r0 | — |
| Alpine v3.14 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.14 | nginx | 1.16.1-r0 | — |
| Alpine v3.14 | nodejs | 10.16.3-r0 | — |
| Alpine v3.13 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.13 | nginx | 1.16.1-r0 | — |
| Alpine v3.13 | nodejs | 10.16.3-r0 | — |
| Alpine v3.12 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.12 | nginx | 1.16.1-r0 | — |
| Alpine v3.12 | nodejs | 10.16.3-r0 | — |
| Alpine v3.11 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.11 | nginx | 1.16.1-r0 | — |
| Alpine v3.11 | nodejs | 10.16.3-r0 | — |
| Alpine v3.10 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.10 | nginx | 1.16.1-r0 | — |
| Alpine v3.10 | nodejs | 10.16.3-r0 | — |
| Alpine v3.9 | nghttp2 | 1.35.1-r1 | — |
| Alpine v3.9 | nginx | 1.14.1-r2 | — |
| Alpine v3.9 | nodejs | 10.16.3-r0 | — |
| Alpine v3.8 | nghttp2 | 1.39.2-r0 | — |
| Alpine v3.8 | nginx | 1.14.1-r1 | — |
| Alpine v3.7 | nghttp2 | 1.39.2-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | nghttp2 +2 | 1.39.2-1.amzn2 | ALAS2-2019-1298 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nghttp2 +2 | 1.33.0-1.el8_0.1 | ELSA-2019-2692 |
| Oracle Linux 8 | nginx +7 | 1:1.14.1-9.0.1.module+el8.0.0+5347+9282027e | ELSA-2019-2799 |
| Oracle Linux 8 | nodejs +2 | 1:10.14.1-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | npm | 1:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
federiconbaez/cortex9-http2-priority-churn-cost-model ★ 0 · Nov 6, 2026
Offline Rust model of the HTTP/2 priority tree with a work counter and nginx PRIORITY budget (CVE-2019-9513 study). No sockets; not a reproduction.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 42
- ALSA-2019:2925 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2019:2799 Important: nginx:1.14 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:3933 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:3932 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:3041 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 1.0.1 RPMs Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2955 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2946 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2949 Red Hat Security Advisory: httpd24-httpd and httpd24-nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2925 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2799 Red Hat Security Advisory: nginx:1.14 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2775 Red Hat Security Advisory: rh-nginx114-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2746 Red Hat Security Advisory: rh-nginx112-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2745 Red Hat Security Advisory: rh-nginx110-nginx security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2692 Red Hat Security Advisory: nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-6754-1 nghttp2 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-4669-1 nodejs - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4505-1 nginx - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4511-1 nghttp2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4099-1 nginx vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RLSA-2019:2799 Important: nginx:1.14 security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2019:2925 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2019:2259-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2309-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2234-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2473-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2559-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2260-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0932-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2264-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2120-1 Security update for nginx SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2114-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2115-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2254-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2232-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1050 nginx: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · May 7, 2024
- ALAS2-2019-1298 Important: nghttp2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 9, 2019
- ELSA-2019-2925 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2019
- ELSA-2019-2799 Important: nginx:1.14 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 19, 2019
- ELSA-2019-2692 Important: nghttp2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 10, 2019
References
- VU#605641 third-party-advisory
- USN-4099-1 vendor-advisory
- FEDORA-2019-befd924cfe vendor-advisory
- 20190822 [SECURITY] [DSA 4505-1] nginx security update mailing-list
- FEDORA-2019-81985a8858 vendor-advisory
- DSA-4505 vendor-advisory
- FEDORA-2019-5a6a7bc12c vendor-advisory
- FEDORA-2019-6a2980de56 vendor-advisory
- FEDORA-2019-8a437d5c2f vendor-advisory
- 20190902 [SECURITY] [DSA 4511-1] nghttp2 security update mailing-list
- DSA-4511 vendor-advisory
- FEDORA-2019-7a0b45fdc4 vendor-advisory
- RHSA-2019:2692 vendor-advisory
- openSUSE-SU-2019:2120 vendor-advisory
- openSUSE-SU-2019:2114 vendor-advisory
- openSUSE-SU-2019:2115 vendor-advisory
- RHSA-2019:2745 vendor-advisory
- RHSA-2019:2746 vendor-advisory
- RHSA-2019:2775 vendor-advisory
- RHSA-2019:2799 vendor-advisory
- RHSA-2019:2925 vendor-advisory
- RHSA-2019:2939 vendor-advisory
- RHSA-2019:2949 vendor-advisory
- openSUSE-SU-2019:2232 vendor-advisory
- openSUSE-SU-2019:2234 vendor-advisory
- RHSA-2019:2955 vendor-advisory
- RHSA-2019:2966 vendor-advisory
- openSUSE-SU-2019:2264 vendor-advisory
- RHSA-2019:3041 vendor-advisory
- RHSA-2019:3933 vendor-advisory
- RHSA-2019:3935 vendor-advisory
- RHSA-2019:3932 vendor-advisory
- DSA-4669 vendor-advisory
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://security.netapp.com/advisory/ntap-20190823-0002/
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://www.oracle.com/security-alerts/cpujan2021.html