CVE-2019-9516

NameCVE-2019-9516
DescriptionSome HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4505-1
Debian Bugs935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nginx (PTS)buster1.14.2-2+deb10u4fixed
buster (security)1.14.2-2+deb10u5fixed
bullseye (security), bullseye1.18.0-6.1+deb11u3fixed
bookworm1.22.1-9fixed
sid, trixie1.24.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nginxsourcejessie(not affected)
nginxsourcestretch1.10.3-1+deb9u3DSA-4505-1
nginxsourcebuster1.14.2-2+deb10u1DSA-4505-1
nginxsource(unstable)1.14.2-3935037

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/6dfbc8b1c2116f362bb871efebbf9df576738e89 (master)
https://github.com/nginx/nginx/commit/dbdd9ffea81d9db46fb88b5eba828f2ad080d388 (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Search for package or bug name: Reporting problems