CVE-2019-9511

Name	CVE-2019-9511
Description	Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-4505-1, DSA-4511-1, DSA-4669-1
Debian Bugs	934885, 935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nghttp2 (PTS)	bullseye	1.43.0-1+deb11u1	fixed
	bullseye (security)	1.43.0-1+deb11u3	fixed
	bookworm, bookworm (security)	1.52.0-1+deb12u3	fixed
	trixie (security), trixie	1.64.0-1.1+deb13u1	fixed
	forky, sid	1.69.0-1	fixed
nginx (PTS)	bullseye	1.18.0-6.1+deb11u3	fixed
	bullseye (security)	1.18.0-6.1+deb11u8	fixed
	bookworm, bookworm (security)	1.22.1-9+deb12u9	fixed
	trixie (security), trixie	1.26.3-3+deb13u7	fixed
	forky, sid	1.30.1-7	fixed
nodejs (PTS)	bullseye	12.22.12~dfsg-1~deb11u4	fixed
	bullseye (security)	12.22.12~dfsg-1~deb11u8	fixed
	bookworm, bookworm (security)	18.20.4+dfsg-1~deb12u2	fixed
	trixie (security), trixie	20.19.2+dfsg-1+deb13u2	fixed
	forky, sid	24.18.0+dfsg+~cs24.13.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
nghttp2	source	jessie	(not affected)
nghttp2	source	stretch	1.18.1-1+deb9u1	DSA-4511-1
nghttp2	source	buster	1.36.0-2+deb10u1	DSA-4511-1
nghttp2	source	(unstable)	1.39.2-1
nginx	source	jessie	(not affected)
nginx	source	stretch	1.10.3-1+deb9u3	DSA-4505-1
nginx	source	buster	1.14.2-2+deb10u1	DSA-4505-1
nginx	source	(unstable)	1.14.2-3		935037
nodejs	source	jessie	(not affected)
nodejs	source	stretch	(not affected)
nodejs	source	buster	10.19.0~dfsg1-1	DSA-4669-1
nodejs	source	(unstable)	10.16.3~dfsg-1		934885

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nghttp2 <not-affected> (Vulnerable code not present)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/a987f81dd19210bc30b62591db331e31d3d74089 (master)
https://github.com/nginx/nginx/commit/94c5eb142e58a86f81eb1369fa6fcb96c2f23d6b (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2