Description
Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache2 | 2.4.41-1 | — |
| Debian 13 | apache2 | 2.4.41-1 | — |
| Debian 12 | apache2 | 2.4.41-1 | — |
| Debian 10 | apache2 | 2.4.38-3+deb10u1 | DSA-4509-1 |
| Debian 9 | apache2 | 2.4.25-3+deb9u8 | DSA-4509-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | apache2 | 2.4.29-1ubuntu4.10 | USN-4113-1 |
| Ubuntu 16.04 LTS | apache2 | 2.4.18-2ubuntu3.12 | USN-4113-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | httpd +7 | 2.4.37-12.module+el8.0.0+4096+eb40e6da | RHSA-2019:2893 |
| RHEL 8 | mod_http2 | 1.11.3-3.module+el8.0.0+4096+eb40e6da | RHSA-2019:2893 |
| RHEL 8 | mod_ssl +1 | 1:2.4.37-12.module+el8.0.0+4096+eb40e6da | RHSA-2019:2893 |
| RHEL 8 | nodejs +2 | 1:10.16.3-2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2019:2925 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2019:2925 |
| RHEL 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 3 | httpd24-httpd +5 | 2.4.34-8.el6.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-mod_md | 2.4.34-8.el7.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-mod_ssl +1 | 1:2.4.34-8.el6.1 | RHSA-2019:2949 |
| RHEL 3 | httpd24-nghttp2 +2 | 1.7.1-7.el6.1 | RHSA-2019:2949 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8 +2 | 3.0-5.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.1-2.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.1.2.el7 | RHSA-2019:2955 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr +1 | 1.6.3-63.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr-util +8 | 1.6.1-48.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-brotli +1 | 1.0.6-7.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 7.64.1-14.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-jansson +1 | 2.11-20.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.12-9.Final_redhat_2.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +2 | 1.2.46-22.redhat_1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_md | 2.4.37-33.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_security | 2.9.2-16.GA.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.29-41.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.39.2-1.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932, RHSA-2019:2946 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1-25.jbcs.el6 | RHSA-2019:3933, RHSA-2019:3932 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | apache2 | 2.4.33-3.21.1 | SUSE-SU-2019:2237-1 |
| SLES 15 SP1 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 SP1 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 15 | apache2 | 2.4.33-3.21.1 | SUSE-SU-2019:2237-1 |
| SLES 15 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 12 SP4 | apache2 | 2.4.23-29.43.1 | SUSE-SU-2019:2329-1 |
| SLES 12 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2254-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | apache2 | 2.4.23-29.43.1 | SUSE-SU-2019:2329-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apache2 | 2.4.49-1.1 | openSUSE-SU-2024:10623-1 |
| openSUSE Leap 15.1 | apache2 | 2.4.33-lp151.8.6.1 | openSUSE-SU-2019:2051-1 |
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
| openSUSE Leap 15.0 | apache2 | 2.4.33-lp151.8.6.1 | openSUSE-SU-2019:2051-1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apache2 | 2.4.41-r0 | — |
| Alpine v3.24 | nodejs | 10.16.3-r0 | — |
| Alpine v3.23 | apache2 | 2.4.41-r0 | — |
| Alpine v3.23 | nodejs | 10.16.3-r0 | — |
| Alpine v3.22 | apache2 | 2.4.41-r0 | — |
| Alpine v3.22 | nodejs | 10.16.3-r0 | — |
| Alpine v3.21 | apache2 | 2.4.41-r0 | — |
| Alpine v3.21 | nodejs | 10.16.3-r0 | — |
| Alpine v3.20 | apache2 | 2.4.41-r0 | — |
| Alpine v3.20 | nodejs | 10.16.3-r0 | — |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apache2 | 2.4.41-r0 | — |
| Alpine v3.19 | nodejs | 10.16.3-r0 | — |
| Alpine v3.18 | apache2 | 2.4.41-r0 | — |
| Alpine v3.18 | nodejs | 10.16.3-r0 | — |
| Alpine v3.17 | apache2 | 2.4.41-r0 | — |
| Alpine v3.17 | nodejs | 10.16.3-r0 | — |
| Alpine v3.16 | apache2 | 2.4.41-r0 | — |
| Alpine v3.16 | nodejs | 10.16.3-r0 | — |
| Alpine v3.15 | apache2 | 2.4.41-r0 | — |
| Alpine v3.15 | nodejs | 10.16.3-r0 | — |
| Alpine v3.14 | apache2 | 2.4.41-r0 | — |
| Alpine v3.14 | nodejs | 10.16.3-r0 | — |
| Alpine v3.13 | apache2 | 2.4.41-r0 | — |
| Alpine v3.13 | nodejs | 10.16.3-r0 | — |
| Alpine v3.12 | apache2 | 2.4.41-r0 | — |
| Alpine v3.12 | nodejs | 10.16.3-r0 | — |
| Alpine v3.11 | apache2 | 2.4.41-r0 | — |
| Alpine v3.11 | nodejs | 10.16.3-r0 | — |
| Alpine v3.10 | apache2 | 2.4.41-r0 | — |
| Alpine v3.10 | nodejs | 10.16.3-r0 | — |
| Alpine v3.9 | apache2 | 2.4.41-r0 | — |
| Alpine v3.9 | nodejs | 10.16.3-r0 | — |
| Alpine v3.8 | apache2 | 2.4.41-r0 | — |
| Alpine v3.7 | apache2 | 2.4.41-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mod_http2 | 1.15.3-2.amzn2 | ALAS2-2019-1342 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | httpd +7 | 2.4.37-12.0.1.module+el8.0.0+5348+de75177e | ELSA-2019-2893 |
| Oracle Linux 8 | mod_http2 | 1.11.3-3.module+el8.0.0+5348+de75177e | ELSA-2019-2893 |
| Oracle Linux 8 | mod_ssl +1 | 1:2.4.37-12.0.1.module+el8.0.0+5348+de75177e | ELSA-2019-2893 |
| Oracle Linux 8 | nodejs +2 | 1:10.14.1-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | npm | 1:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
Advisories 27
- ALSA-2019:2925 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:3933 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:3932 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2019:2955 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2946 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2949 Red Hat Security Advisory: httpd24-httpd and httpd24-nghttp2 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2893 Red Hat Security Advisory: httpd:2.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2925 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4113-1 apache2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4509-1 apache2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2019:2925 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2019:2259-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2051-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2260-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2237-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2114-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2329-1 Security update for apache2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2115-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10623-1 apache2-2.4.49-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2254-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024
- ALAS2-2019-1342 Important: mod_http2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 30, 2019
- ELSA-2019-2925 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2019
- ELSA-2019-2893 Important: httpd:2.4 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 24, 2019
References
- VU#605641 third-party-advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- [httpd-announce] 20190814 CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workers mailing-list
- [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [oss-security] 20190814 CVE-2019-9517: mod_http2, DoS attack by exhausting h2 workers mailing-list
- [httpd-dev] 20190817 CVE-2019-10097 vs. CHANGEs entry mailing-list
- [httpd-dev] 20190817 Re: CVE-2019-10097 vs. CHANGEs entry mailing-list
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K02591030
- https://security.netapp.com/advisory/ntap-20190823-0005/
- https://security.netapp.com/advisory/ntap-20190823-0003/
- FEDORA-2019-5a6a7bc12c vendor-advisory
- FEDORA-2019-6a2980de56 vendor-advisory
- DSA-4509 vendor-advisory
- 20190826 [SECURITY] [DSA 4509-1] apache2 security update mailing-list
- USN-4113-1 vendor-advisory
- FEDORA-2019-4427fd65be vendor-advisory
- FEDORA-2019-63ba15cc83 vendor-advisory
- openSUSE-SU-2019:2051 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190905-0003/
- GLSA-201909-04 vendor-advisory
- openSUSE-SU-2019:2114 vendor-advisory
- openSUSE-SU-2019:2115 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- RHSA-2019:2893 vendor-advisory
- RHSA-2019:2925 vendor-advisory
- RHSA-2019:2939 vendor-advisory
- RHSA-2019:2946 vendor-advisory
- RHSA-2019:2950 vendor-advisory
- RHSA-2019:2949 vendor-advisory
- RHSA-2019:2955 vendor-advisory
- https://support.f5.com/csp/article/K02591030?utm_source=f5support&%3Butm_medium=RSS
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- RHSA-2019:3933 vendor-advisory
- RHSA-2019:3935 vendor-advisory
- RHSA-2019:3932 vendor-advisory
- [httpd-cvs] 20200401 svn commit: r1058586 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- [httpd-cvs] 20200401 svn commit: r1058587 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilit mailing-list
- https://www.oracle.com/security-alerts/cpuapr2020.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073143 [3/3] - in /websites/staging/httpd/trunk/content: ./ security/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073140 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.ht mailing-list
- [httpd-cvs] 20210330 svn commit: r1073139 [12/13] - in /websites/staging/httpd/trunk/content: ./ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1888194 [12/13] - /httpd/site/trunk/content/security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210330 svn commit: r1073149 [13/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/ mailing-list
- [httpd-cvs] 20210606 svn commit: r1075470 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabiliti mailing-list