{"cve":"CVE-2019-9514","nvd":{"published":"2019-08-13T21:15:12.443","modified":"2026-06-17T02:43:52.407","status":"Modified","description":"Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770","CWE-400"],"references":["http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html"],"products":["apache:traffic_server","apple:swiftnio","canonical:ubuntu_linux","debian:debian_linux","f5:big-ip_local_traffic_manager","fedoraproject:fedora","mcafee:web_gateway","netapp:cloud_insights","netapp:trident","nodejs:node.js","opensuse:leap","oracle:graalvm","redhat:developer_tools","redhat:enterprise_linux","redhat:enterprise_linux_eus","redhat:enterprise_linux_server","redhat:enterprise_linux_workstation","redhat:jboss_core_services","redhat:jboss_enterprise_application_platform","redhat:openshift_container_platform","redhat:openshift_service_mesh","redhat:openstack","redhat:quay","redhat:single_sign-on","redhat:software_collections","synology:diskstation_manager","synology:skynas","synology:vs960hd_firmware"],"source":"nvd","synced_at":"2026-10-19T20:58:11.797917892+00:00"},"epss":{"cve":"CVE-2019-9514","score":0.82813,"percentile":0.9967,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-39qc-96h7-956f","url":"https://osv.dev/vulnerability/GHSA-39qc-96h7-956f","summary":"golang.org/x/net/http vulnerable to a reset flood","modified":"2026-09-10T03:49:07.223896328Z","packages":[{"ecosystem":"Go","name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net","ranges":["<0.0.0-20190813141303-74dc4d7220e7"],"fixed":["0.0.0-20190813141303-74dc4d7220e7"]}]},{"id":"GHSA-hgr8-6h9x-f7q9","url":"https://osv.dev/vulnerability/GHSA-hgr8-6h9x-f7q9","summary":"golang.org/x/net/http vulnerable to ping floods","modified":"2026-09-10T03:49:38.758913878Z","packages":[{"ecosystem":"Go","name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net","ranges":["<0.0.0-20190813141303-74dc4d7220e7"],"fixed":["0.0.0-20190813141303-74dc4d7220e7"]}]},{"id":"GO-2022-0536","url":"https://osv.dev/vulnerability/GO-2022-0536","summary":"Reset flood in net/http and golang.org/x/net/http","modified":"2026-02-04T02:16:01.342268Z","packages":[{"ecosystem":"Go","name":"stdlib","purl":"pkg:golang/stdlib","ranges":["<1.11.13",">=1.12.0-0 <1.12.8"],"fixed":["1.11.13","1.12.8"]},{"ecosystem":"Go","name":"golang.org/x/net","purl":"pkg:golang/golang.org/x/net","ranges":["<0.0.0-20190813141303-74dc4d7220e7"],"fixed":["0.0.0-20190813141303-74dc4d7220e7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}