CVE-2019-9513

NameCVE-2019-9513
DescriptionSome HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4505-1, DSA-4511-1, DSA-4669-1
Debian Bugs934885, 935037

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nghttp2 (PTS)buster1.36.0-2+deb10u1fixed
buster (security)1.36.0-2+deb10u2fixed
bullseye (security), bullseye1.43.0-1+deb11u1fixed
bookworm, bookworm (security)1.52.0-1+deb12u1fixed
sid, trixie1.59.0-1fixed
nginx (PTS)buster1.14.2-2+deb10u4fixed
buster (security)1.14.2-2+deb10u5fixed
bullseye (security), bullseye1.18.0-6.1+deb11u3fixed
bookworm1.22.1-9fixed
sid, trixie1.24.0-2fixed
nodejs (PTS)buster10.24.0~dfsg-1~deb10u1fixed
buster (security)10.24.0~dfsg-1~deb10u3fixed
bullseye (security), bullseye12.22.12~dfsg-1~deb11u4fixed
bookworm18.13.0+dfsg1-1fixed
bookworm (security)18.19.0+dfsg-6~deb12u1fixed
trixie18.19.1+dfsg-3fixed
sid18.19.1+dfsg-3.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nghttp2sourcejessie(not affected)
nghttp2sourcestretch1.18.1-1+deb9u1DSA-4511-1
nghttp2sourcebuster1.36.0-2+deb10u1DSA-4511-1
nghttp2source(unstable)1.39.2-1
nginxsourcejessie(not affected)
nginxsourcestretch1.10.3-1+deb9u3DSA-4505-1
nginxsourcebuster1.14.2-2+deb10u1DSA-4505-1
nginxsource(unstable)1.14.2-3935037
nodejssourcejessie(not affected)
nodejssourcestretch(not affected)
nodejssourcebuster10.19.0~dfsg1-1DSA-4669-1
nodejssource(unstable)10.16.3~dfsg-1934885

Notes

[jessie] - nginx <not-affected> (HTTP2 support only exists since version 1.9.5)
[stretch] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nodejs <not-affected> (No HTTP2 support yet)
[jessie] - nghttp2 <not-affected> (Vulnerable code not present)
https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/
https://github.com/nginx/nginx/commit/5ae726912654da10a9a81b2c8436829f3e94f69f (master)
https://github.com/nginx/nginx/commit/39bb3b9d4a33bd03c8ae0134dedc8a7700ae7b2b (release-1.16.1)
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/
https://github.com/nghttp2/nghttp2/releases/tag/v1.39.2

Search for package or bug name: Reporting problems