CVE-2019-9517

Publication date 13 August 2019

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.

Read the notes from the security team

Mitigation

Disable http2 support

Status

Show unmaintained releases

Package	Ubuntu Release	Status
apache2	19.04 disco	Fixed 2.4.38-2ubuntu2.2
	18.10 cosmic	Ignored end of life
	18.04 LTS bionic	Fixed 2.4.29-1ubuntu4.10
	16.04 LTS xenial	Not affected
	14.04 LTS trusty	Not affected

Notes

sbeattie

apache2 2.4.18 in xenial does not build mod_http2

Severity score breakdown

Parameter	Value
Base score	7.5 · High
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Related Ubuntu Security Notices (USN)

USN-4113-1
Apache HTTP Server vulnerabilities
29 August 2019