CVE-2019-9514

7.5 highEPSS 83%

High (7.5). EPSS 83% chance of exploitation in the next 30 days. Fixed in golang.org/x/net 0.0.0-20190813141303-74dc4d7220e7.

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 83% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-770, CWE-400
Published: 2019-08-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:traffic_server
apple:swiftnio
canonical:ubuntu_linux
debian:debian_linux
f5:big-ip_local_traffic_manager
fedoraproject:fedora
mcafee:web_gateway
netapp:cloud_insights
netapp:trident
nodejs:node.js
opensuse:leap
oracle:graalvm
redhat:developer_tools
redhat:enterprise_linux
redhat:enterprise_linux_eus
redhat:enterprise_linux_server
redhat:enterprise_linux_workstation
redhat:jboss_core_services
redhat:jboss_enterprise_application_platform
redhat:openshift_container_platform
redhat:openshift_service_mesh
redhat:openstack
redhat:quay
redhat:single_sign-on
redhat:software_collections
synology:diskstation_manager
synology:skynas
synology:vs960hd_firmware

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-39qc-96h7-956f	Go	golang.org/x/net	<0.0.0-20190813141303-74dc4d7220e7	0.0.0-20190813141303-74dc4d7220e7
GHSA-hgr8-6h9x-f7q9	Go	golang.org/x/net	<0.0.0-20190813141303-74dc4d7220e7	0.0.0-20190813141303-74dc4d7220e7
GO-2022-0536	Go	stdlib	<1.11.13 >=1.12.0-0 <1.12.8	1.11.13, 1.12.8
GO-2022-0536	Go	golang.org/x/net	<0.0.0-20190813141303-74dc4d7220e7	0.0.0-20190813141303-74dc4d7220e7

References

Check your stack JSON