Debian Security Bug TrackerDEBIANCVE:CVE-2019-9515CVE-2019-9515
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
92.1%
Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | h2o | < 2.2.5+dfsg2-3 | h2o_2.2.5+dfsg2-3_all.deb |
| Debian | 11 | all | h2o | < 2.2.5+dfsg2-3 | h2o_2.2.5+dfsg2-3_all.deb |
| Debian | 999 | all | h2o | < 2.2.5+dfsg2-3 | h2o_2.2.5+dfsg2-3_all.deb |
| Debian | 12 | all | trafficserver | < 8.0.5+ds-1 | trafficserver_8.0.5+ds-1_all.deb |
| Debian | 11 | all | trafficserver | < 8.0.5+ds-1 | trafficserver_8.0.5+ds-1_all.deb |
| Debian | 999 | all | trafficserver | < 8.0.5+ds-1 | trafficserver_8.0.5+ds-1_all.deb |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
Percentile
92.1%