VYPR
← All advisories
High severityNVD Advisory· Published Aug 13, 2019· Updated Aug 4, 2024

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

CVE-2019-9512

Description

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2019-9512 is an HTTP/2 ping flood vulnerability that can cause denial of service by exhausting the target's CPU and memory resources.

Vulnerability

Overview

CVE-2019-9512 affects HTTP/2 implementations that mishandle PING frames. The attacker sends a continuous stream of pings to the peer, forcing it to build an internal queue of responses. If the implementation does not efficiently handle this queuing, it can lead to excessive CPU and memory consumption, resulting in a denial of service.[1][2]

Exploitation and

Attack Surface

Exploitation requires only the ability to establish an HTTP/2 connection to the target. No authentication or special privileges are needed. The attacker simply sends a high rate of PING frames, and the target's internal response queue grows unchecked. This is a straightforward amplification-based attack that can be carried out with low bandwidth.[1]

Impact

Successful exploitation causes the target to become unresponsive or crash due to resource exhaustion. The impact is a denial of service affecting the availability of the HTTP/2 service. Affected products include Red Hat JBoss Enterprise Application Platform (Undertow), Go, and Node.js, as indicated by multiple Red Hat security advisories.[2][3][4]

Mitigation

Red Hat released updates for Undertow in RHSA-2019:4019, for Go in RHSA-2019:2726, and for Node.js in RHSA-2019:2925. Affected users should apply the latest patches. No workarounds are mentioned, so upgrading is the recommended mitigation.[2][3][4]

References
  1. https://access.redhat.com/errata/RHSA-2019:4269
  2. https://access.redhat.com/errata/RHSA-2019:4019
  3. https://access.redhat.com/errata/RHSA-2019:2726
  4. https://access.redhat.com/errata/RHSA-2019:2925

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
golang.org/x/netGo
< 0.0.0-20190813141303-74dc4d7220e70.0.0-20190813141303-74dc4d7220e7

Affected products

38

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

85

News mentions

0

No linked articles in our index yet.