Description
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | h2o | 2.2.5+dfsg2-3 | — |
| Debian 12 | trafficserver | 8.0.5+ds-1 | — |
| Debian 10 | h2o | 2.2.5+dfsg2-2+deb10u1 | DSA-4508-1 |
| Debian 10 | trafficserver | 8.0.2+ds-1+deb10u1 | DSA-4520-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | grpc +1 | No fix yet | — |
| Ubuntu 26.04 LTS | golang-google-grpc | No fix yet | — |
| Ubuntu 25.10 | grpc +1 | No fix yet | — |
| Ubuntu 24.04 LTS | grpc | No fix yet | — |
| Ubuntu 20.04 LTS | grpc +1 | No fix yet | — |
| Ubuntu 20.04 LTS | twisted | 18.9.0-6ubuntu1 | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | grpc +2 | No fix yet | — |
| Ubuntu 18.04 LTS | twisted | 17.9.0-2ubuntu0.1 | USN-4308-1 |
| Ubuntu 16.04 LTS | grpc +2 | No fix yet | — |
| Ubuntu 16.04 LTS | twisted | 16.0.0-1ubuntu0.4 | USN-4308-1 |
| Ubuntu Pro 18.04 LTS | h2o | No fix yet | — |
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm1 | USN-4866-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +2 | 1:10.16.3-2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2019:2925 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2019:2925 |
| RHEL 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8 +2 | 3.0-5.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.1-2.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.1.2.el7 | RHSA-2019:2955 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 4.8.15-1.Final_redhat_00001.1.el6sso | RHSA-2019:4042, RHSA-2019:4041, RHSA-2019:4040 |
| Red Hat OpenStack 14 | skydive +4 | 0.20.5-2.el7ost | RHSA-2019:2796 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-commons-beanutils | 1.9.4-1.redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-infinispan +5 | 8.2.11-1.SP2_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.5-1.redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-log4j-jboss-logmanager | 1.2.2-1.Final_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.45-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-undertow | 1.4.18-12.SP12_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.7-2.GA_redhat_00002.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-elytron | 1.1.13-1.Final_redhat_00001.1.ep7.el7 | RHSA-2024:5856 |
| Red Hat JBoss EAP 7 | eap7-apache-cxf +3 | 3.2.10-1.redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-byte-buddy | 1.9.11-1.redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-glassfish-jsf | 2.3.5-5.SP3_redhat_00003.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-hal-console | 3.0.17-2.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-hibernate +4 | 5.3.13-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.4.18-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-genericjms | 2.0.2-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-msc | 1.4.11-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 5.0.16-2.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-server-migration +23 | 1.3.1-6.Final_redhat_00006.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.7.6-2.SP1_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-picketbox +1 | 5.0.3-6.Final_redhat_00005.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-picketlink-api +9 | 2.5.5-20.SP12_redhat_00009.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-resteasy +19 | 3.6.1-7.SP7_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-undertow | 2.0.26-2.SP3_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly +2 | 7.2.5-4.GA_redhat_00002.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron | 1.6.5-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-elytron-tool | 1.4.4-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-http-client +4 | 1.0.17-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-java-jdk8 +1 | 7.2.5-4.GA_redhat_00002.1.el7eap | RHSA-2019:4019 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl +1 | 1.0.8-1.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-wildfly-openssl-linux-x86_64 | 1.0.8-5.Final_redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
| Red Hat JBoss EAP 7 | eap7-yasson | 1.0.5-1.redhat_00001.1.el6eap | RHSA-2019:4020, RHSA-2019:4019, RHSA-2019:4018 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 SP1 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 15 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 12 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2254-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | containerd | 1.2.9-r0 | — |
| Alpine v3.24 | nodejs | 10.16.3-r0 | — |
| Alpine v3.24 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.23 | containerd | 1.2.9-r0 | — |
| Alpine v3.23 | nodejs | 10.16.3-r0 | — |
| Alpine v3.23 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.22 | containerd | 1.2.9-r0 | — |
| Alpine v3.22 | nodejs | 10.16.3-r0 | — |
| Alpine v3.22 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.21 | containerd | 1.2.9-r0 | — |
| Alpine v3.21 | nodejs | 10.16.3-r0 | — |
| Alpine v3.21 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.20 | containerd | 1.2.9-r0 | — |
| Alpine v3.20 | nodejs | 10.16.3-r0 | — |
| Alpine v3.20 | py3-twisted | 19.10.0-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | containerd | 1.2.9-r0 | — |
| Alpine v3.19 | h2o | 2.2.6-r0 | — |
| Alpine v3.19 | nodejs | 10.16.3-r0 | — |
| Alpine v3.19 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.18 | containerd | 1.2.9-r0 | — |
| Alpine v3.18 | h2o | 2.2.6-r0 | — |
| Alpine v3.18 | nodejs | 10.16.3-r0 | — |
| Alpine v3.18 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.17 | containerd | 1.2.9-r0 | — |
| Alpine v3.17 | h2o | 2.2.6-r0 | — |
| Alpine v3.17 | nodejs | 10.16.3-r0 | — |
| Alpine v3.17 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.16 | containerd | 1.2.9-r0 | — |
| Alpine v3.16 | h2o | 2.2.6-r0 | — |
| Alpine v3.16 | nodejs | 10.16.3-r0 | — |
| Alpine v3.16 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.15 | containerd | 1.2.9-r0 | — |
| Alpine v3.15 | h2o | 2.2.6-r0 | — |
| Alpine v3.15 | nodejs | 10.16.3-r0 | — |
| Alpine v3.15 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.14 | containerd | 1.2.9-r0 | — |
| Alpine v3.14 | h2o | 2.2.6-r0 | — |
| Alpine v3.14 | nodejs | 10.16.3-r0 | — |
| Alpine v3.14 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.13 | containerd | 1.2.9-r0 | — |
| Alpine v3.13 | h2o | 2.2.6-r0 | — |
| Alpine v3.13 | nodejs | 10.16.3-r0 | — |
| Alpine v3.13 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.12 | containerd | 1.2.9-r0 | — |
| Alpine v3.12 | h2o | 2.2.6-r0 | — |
| Alpine v3.12 | nodejs | 10.16.3-r0 | — |
| Alpine v3.12 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.11 | containerd | 1.2.9-r0 | — |
| Alpine v3.11 | h2o | 2.2.6-r0 | — |
| Alpine v3.11 | nodejs | 10.16.3-r0 | — |
| Alpine v3.11 | py3-twisted | 19.10.0-r0 | — |
| Alpine v3.10 | containerd | 1.2.9-r0 | — |
| Alpine v3.10 | nodejs | 10.16.3-r0 | — |
| Alpine v3.9 | nodejs | 10.16.3-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +2 | 1:10.14.1-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | npm | 1:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
Advisories 28
- ALSA-2019:2925 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:5856 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4041 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4042 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4040 Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4020 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4018 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:4019 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2955 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2925 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2796 Red Hat Security Advisory: skydive security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4866-1 netty vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-4308-1 twisted vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4508-1 h2o - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-4520-1 trafficserver - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2026-0426 Apache Traffic Server: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Feb 16, 2026
- RLSA-2019:2925 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2019:2259-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2260-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2114-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2115-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2254-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
- WID-SEC-2024-1926 Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 24, 2024
- ELSA-2019-2925 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2019
References
- VU#605641 third-party-advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- [trafficserver-dev] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks mailing-list
- [trafficserver-users] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks mailing-list
- [trafficserver-announce] 20190813 Apache Traffic Server is vulnerable to various HTTP/2 attacks mailing-list
- 20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 mailing-list
- 20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 mailing-list
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K50233772
- https://security.netapp.com/advisory/ntap-20190823-0005/
- FEDORA-2019-5a6a7bc12c vendor-advisory
- FEDORA-2019-6a2980de56 vendor-advisory
- 20190825 [SECURITY] [DSA 4508-1] h2o security update mailing-list
- DSA-4508 vendor-advisory
- DSA-4520 vendor-advisory
- 20190910 [SECURITY] [DSA 4520-1] trafficserver security update mailing-list
- openSUSE-SU-2019:2114 vendor-advisory
- openSUSE-SU-2019:2115 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- RHSA-2019:2766 vendor-advisory
- RHSA-2019:2796 vendor-advisory
- RHSA-2019:2861 vendor-advisory
- RHSA-2019:2925 vendor-advisory
- RHSA-2019:2939 vendor-advisory
- RHSA-2019:2955 vendor-advisory
- https://support.f5.com/csp/article/K50233772?utm_source=f5support&%3Butm_medium=RSS
- RHSA-2019:3892 vendor-advisory
- RHSA-2019:4018 vendor-advisory
- RHSA-2019:4019 vendor-advisory
- RHSA-2019:4021 vendor-advisory
- RHSA-2019:4020 vendor-advisory
- RHSA-2019:4045 vendor-advisory
- RHSA-2019:4042 vendor-advisory
- RHSA-2019:4040 vendor-advisory
- RHSA-2019:4041 vendor-advisory
- RHSA-2019:4352 vendor-advisory
- RHSA-2020:0727 vendor-advisory
- USN-4308-1 vendor-advisory