CVE-2019-9516

Published: 13 August 2019

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
nginx
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 18.04 LTS (Bionic Beaver)
Released (1.14.0-0ubuntu1.4)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (1.10.3-0ubuntu0.16.04.4)
Ubuntu 14.04 ESM (Trusty Tahr) Not vulnerable
(http2 support not implemented)
Patches:
Upstream: https://github.com/nginx/nginx/commit/dbdd9ffea81d9db46fb88b5eba828f2ad080d388