{"cve":"CVE-2019-9512","nvd":{"published":"2019-08-13T21:15:12.287","modified":"2026-06-17T02:43:51.673","status":"Modified","description":"Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-400"],"references":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html"],"products":["apache:traffic_server","apple:swiftnio","debian:debian_linux","nodejs:node.js"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2019-9512","score":0.83433,"percentile":0.99683,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-39qc-96h7-956f","url":"https://osv.dev/vulnerability/GHSA-39qc-96h7-956f","summary":"golang.org/x/net/http vulnerable to a reset flood","modified":"2026-09-10T03:49:07.223896328Z","packages":[{"ecosystem":"Go","name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net","ranges":["<0.0.0-20190813141303-74dc4d7220e7"],"fixed":["0.0.0-20190813141303-74dc4d7220e7"]}]},{"id":"GHSA-hgr8-6h9x-f7q9","url":"https://osv.dev/vulnerability/GHSA-hgr8-6h9x-f7q9","summary":"golang.org/x/net/http vulnerable to ping floods","modified":"2026-09-10T03:49:38.758913878Z","packages":[{"ecosystem":"Go","name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net","ranges":["<0.0.0-20190813141303-74dc4d7220e7"],"fixed":["0.0.0-20190813141303-74dc4d7220e7"]}]},{"id":"GO-2022-0536","url":"https://osv.dev/vulnerability/GO-2022-0536","summary":"Reset flood in net/http and golang.org/x/net/http","modified":"2026-02-04T02:16:01.342268Z","packages":[{"ecosystem":"Go","name":"stdlib","purl":"pkg:golang/stdlib","ranges":["<1.11.13",">=1.12.0-0 <1.12.8"],"fixed":["1.11.13","1.12.8"]},{"ecosystem":"Go","name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net","ranges":["<0.0.0-20190813141303-74dc4d7220e7"],"fixed":["0.0.0-20190813141303-74dc4d7220e7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}