Denial of Service Vulnerability in nghttp2 and nginx Packages
Summary
ALPINE-CVE-2019-9511: Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. Affects nghttp2 versions < 1.39.2-r0. Fixed in 1.39.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
nghttp2 is a popular HTTP/2 client and server implementation that enables efficient communication over the web. It is widely used in various applications to enhance performance through multiplexing and header compression. However, certain versions of nghttp2 and nginx, which rely on this library, are susceptible to a critical vulnerability that can lead to denial of service (DoS) attacks, affecting the availability of services that utilize these packages.
Vulnerability Detail
The vulnerability, identified as CVE-2019-9511, arises from improper handling of window size and stream prioritization in HTTP/2 implementations. An attacker can exploit this flaw by sending a large number of requests for data over multiple streams, manipulating the window size and stream priority to force the server to queue data inefficiently. This can lead to excessive consumption of CPU and memory resources, potentially resulting in service outages. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.39.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade nghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of concurrent streams or implement rate limiting on your server to mitigate the impact of potential exploitation until the packages can be updated.
Conclusion
In summary, CVE-2019-9511 poses a significant risk to applications using nghttp2 and nginx due to its potential to cause denial of service. It is crucial to update to the latest patched versions of these packages to ensure the security and availability of your services. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nghttp2 →
FAQ
CVE-2019-9511 is a vulnerability in the nghttp2 and nginx packages that allows attackers to exploit window size manipulation and stream prioritization, potentially leading to denial of service.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to analyze your manifest file for vulnerabilities without requiring any signup.
The consequences include potential service outages due to excessive CPU and memory consumption, which can disrupt the availability of applications relying on the affected packages.
Yes, patches are available. Update nghttp2 to version 1.39.2-r0 or later and nginx to version 1.16.1-r0 or later to mitigate the vulnerability.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software by analyzing manifest files like package-lock.json, providing insights without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for nghttp2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
