Description
Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | trafficserver | 8.0.5+ds-1 | — |
| Debian 10 | trafficserver | 8.0.2+ds-1+deb10u1 | DSA-4520-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | trafficserver | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | netty | 1:4.1.7-4ubuntu0.1+esm1 | USN-4866-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | nodejs +2 | 1:10.16.3-2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 8 | nodejs-nodemon | 1.18.3-1.module+el8+2632+6c5111ed | RHSA-2019:2925 |
| RHEL 8 | nodejs-packaging | 17-3.module+el8+2873+aa7dfd9a | RHSA-2019:2925 |
| RHEL 8 | npm | 1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda | RHSA-2019:2925 |
| RHEL 3 | rh-nodejs10 +2 | 3.2-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-nodejs +2 | 10.16.3-3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs10-npm | 6.9.0-10.16.3.3.el7 | RHSA-2019:2939 |
| RHEL 3 | rh-nodejs8 +2 | 3.0-5.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-nodejs +2 | 8.16.1-2.el7 | RHSA-2019:2955 |
| RHEL 3 | rh-nodejs8-npm | 6.4.1-8.16.1.2.el7 | RHSA-2019:2955 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | nodejs-nodemon | 1.18.3-1.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
| AlmaLinux 8 | nodejs-packaging | 17-3.module_el8.3.0+2023+d2377ea3 | ALSA-2019:2925 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
| Rocky Linux 8 | nodejs-packaging | 17-3.module+el8.3.0+101+f84c7154 | RLSA-2019:2925 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 SP1 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 15 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2259-1 |
| SLES 15 | nodejs8 | 8.16.1-3.20.1 | SUSE-SU-2019:2260-1 |
| SLES 12 | nodejs10 | 10.16.3-1.12.1 | SUSE-SU-2019:2254-1 |
| SLES 12 | nodejs12 | 12.13.0-1.3.1 | SUSE-SU-2020:0059-1 |
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.1 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
| openSUSE Leap 15.0 | nodejs10 | 10.16.3-lp151.2.6.1 | openSUSE-SU-2019:2114-1 |
| openSUSE Leap 15.0 | nodejs8 | 8.16.1-lp151.2.6.1 | openSUSE-SU-2019:2115-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs | 10.16.3-r0 | — |
| Alpine v3.23 | nodejs | 10.16.3-r0 | — |
| Alpine v3.22 | nodejs | 10.16.3-r0 | — |
| Alpine v3.21 | nodejs | 10.16.3-r0 | — |
| Alpine v3.20 | nodejs | 10.16.3-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs | 10.16.3-r0 | — |
| Alpine v3.18 | nodejs | 10.16.3-r0 | — |
| Alpine v3.17 | nodejs | 10.16.3-r0 | — |
| Alpine v3.16 | nodejs | 10.16.3-r0 | — |
| Alpine v3.15 | nodejs | 10.16.3-r0 | — |
| Alpine v3.14 | nodejs | 10.16.3-r0 | — |
| Alpine v3.13 | nodejs | 10.16.3-r0 | — |
| Alpine v3.12 | nodejs | 10.16.3-r0 | — |
| Alpine v3.11 | nodejs | 10.16.3-r0 | — |
| Alpine v3.10 | nodejs | 10.16.3-r0 | — |
| Alpine v3.9 | nodejs | 10.16.3-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | nodejs +2 | 1:10.14.1-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-nodemon | 1.18.3-1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | nodejs-packaging | 17-3.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
| Oracle Linux 8 | npm | 1:6.4.1-1.10.14.1.1.module+el8.0.0+5349+4d6b561f | ELSA-2019-2925 |
Advisories 16
- ALSA-2019:2925 Important: nodejs:10 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2019:2955 Red Hat Security Advisory: rh-nodejs8-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2939 Red Hat Security Advisory: rh-nodejs10-nodejs security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2019:2925 Red Hat Security Advisory: nodejs:10 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- USN-4866-1 netty vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-4520-1 trafficserver - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2019:2925 Important: nodejs:10 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2019:2259-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2260-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:0059-1 Security update for nodejs12 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2114-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2115-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2254-1 Security update for nodejs10 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0770 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 8, 2026
- ELSA-2019-2925 Important: nodejs:10 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Sep 30, 2019
References
- VU#605641 third-party-advisory
- https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- 20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 mailing-list
- 20190816 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 mailing-list
- https://www.synology.com/security/advisory/Synology_SA_19_33
- https://support.f5.com/csp/article/K46011592
- [trafficserver-announce] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frames mailing-list
- [trafficserver-users] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frames mailing-list
- [trafficserver-dev] 20190820 ATS is vulnerable to a HTTP/2 attack with empty frames mailing-list
- https://security.netapp.com/advisory/ntap-20190823-0005/
- FEDORA-2019-5a6a7bc12c vendor-advisory
- FEDORA-2019-6a2980de56 vendor-advisory
- DSA-4520 vendor-advisory
- 20190910 [SECURITY] [DSA 4520-1] trafficserver security update mailing-list
- openSUSE-SU-2019:2114 vendor-advisory
- openSUSE-SU-2019:2115 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10296
- RHSA-2019:2925 vendor-advisory
- RHSA-2019:2939 vendor-advisory
- RHSA-2019:2955 vendor-advisory
- https://support.f5.com/csp/article/K46011592?utm_source=f5support&%3Butm_medium=RSS
- RHSA-2019:3892 vendor-advisory
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities mailing-list
- RHSA-2019:4352 vendor-advisory
- RHSA-2020:0727 vendor-advisory
- [cassandra-commits] 20210526 [jira] [Created] (CASSANDRA-16698) Security vulnerability CVE-2019-9518 for Netty mailing-list
- [cassandra-commits] 20210526 [jira] [Updated] (CASSANDRA-16698) Security vulnerability CVE-2019-9518 for Netty mailing-list