CVE-2019-9511
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potential
Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks.
Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
HIGH · CVSS 7.5
EPSS 0.13725
Schedule remediation
- EPSS ≥ 0.10 - elevated exploitation probability
- EPSS percentile: top 6% of all CVEs by exploitation likelihood
- CVSS base score ≥ 7.0
Sigma rules1
YARA rules0