---
title: "CVE-2019-9516"
canonical: "https://kb.cynergy.app/space/MD/899252770/CVE-2019-9516"
format: markdown
---
**Description:**

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.

**Published On:**

2019-08-13

**Updated On:**

2022-02-22

**Trending:**

FALSE

**CWE:**

CWE-770

**Remediation:**

Update based on the vendor recommendations:

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
| Vendor | Fix Title | Fix Description | Fix Published On | Fix URL |
| apple | Fixed in SwiftNIO HTTP/2 1.5.0 | SwiftNIO HTTP/2<br />&nbsp; &nbsp; &nbsp; &nbsp; Impact: A HTTP/2 server may consume unbounded amounts of memory when receiving certain traffic patterns and eventually suffer resource exhaustion <br />&nbsp; &nbsp; &nbsp; &nbsp; Description: This issue was addressed with improved buffer size management. <br />&nbsp; &nbsp; &nbsp; &nbsp; Available for: SwiftNIO HTTP/2 1.0.0 through 1.4.0 on macOS Sierra 10.12 and later and Ubuntu 14.04 and later <br />SwiftNIO HTTP/2<br />&nbsp; &nbsp; &nbsp; &nbsp; Impact: A HTTP/2 server may consume excessive CPU resources when receiving certain traffic patterns <br />&nbsp; &nbsp; &nbsp; &nbsp; Description: This issue was addressed with improved input validation. <br />&nbsp; &nbsp; &nbsp; &nbsp; Available for: SwiftNIO HTTP/2 1.0.0 through 1.4.0 on macOS Sierra 10.12 and later and Ubuntu 14.04 and later <br /> | 2022-02-20 | [https://support.apple.com/en-us/HT210436](https://support.apple.com/en-us/HT210436) |
| OpenSource | nodejs-packaging-17-3.module+el8+2873+aa7dfd9a | An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2022-04-24 | [https://access.redhat.com/errata/RHSA-2019:2925](https://access.redhat.com/errata/RHSA-2019:2925) |
| OpenSource | nginx-1.14.1-9.module+el8.0.0+4108+af250afe | An update for the nginx:1.14 module is now available for Red Hat Enterprise Linux 8.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2022-04-24 | [https://access.redhat.com/errata/RHSA-2019:2799](https://access.redhat.com/errata/RHSA-2019:2799) |
| mageia | Updated nginx packages fix security vulnerabilities | Updated nginx packages fix security vulnerabilities:<br>When using HTTP/2 a client might cause excessive memory consumption and  
CPU usage (CVE-2019-9511, CVE-2019-9513, CVE-2019-9516). | 2020-04-13 | [http://advisories.mageia.org/MGASA-2019-0342.html](http://advisories.mageia.org/MGASA-2019-0342.html) |
| suse | Security update for nodejs8 | This update for nodejs8 to version 8.16.1 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).<br>Bug fixes:<br>- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).<br>This update was imported from the SUSE:SLE-15:Update update project. | 2019-09-11 | [http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html) |
| suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).<br>This update was imported from the SUSE:SLE-15:Update update project. | 2019-09-11 | [http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html) |
| suse | Security update for nginx | This update for nginx fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
- CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
- CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
- CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015).
- CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022).
- CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025).<br>This update was imported from the SUSE:SLE-15-SP1:Update update project. | 2019-09-11 | [http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html](http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html) |
| suse | Security update for nginx | This update for nginx fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
- CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
- CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).<br>This update was imported from the SUSE:SLE-15:Update update project. | 2019-10-07 | [http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html](http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html) |
| redhat | Red Hat Security Advisory: rh-nginx110-nginx security update | An update for rh-nginx110-nginx is now available for Red Hat Software Collections.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-13 | [https://access.redhat.com/errata/RHSA-2019:2745](https://access.redhat.com/errata/RHSA-2019:2745) |
| redhat | Red Hat Security Advisory: rh-nginx112-nginx security update | An update for rh-nginx112-nginx is now available for Red Hat Software Collections.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-13 | [https://access.redhat.com/errata/RHSA-2019:2746](https://access.redhat.com/errata/RHSA-2019:2746) |
| redhat | Red Hat Security Advisory: rh-nginx114-nginx security update | An update for rh-nginx114-nginx is now available for Red Hat Software Collections.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-18 | [https://access.redhat.com/errata/RHSA-2019:2775](https://access.redhat.com/errata/RHSA-2019:2775) |
| redhat | Red Hat Security Advisory: nginx:1.14 security update | An update for the nginx:1.14 module is now available for Red Hat Enterprise Linux 8.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-20 | [https://access.redhat.com/errata/RHSA-2019:2799](https://access.redhat.com/errata/RHSA-2019:2799) |
| redhat | Red Hat Security Advisory: nodejs:10 security update | An update for the nodejs:10 module is now available for Red Hat Enterprise Linux 8.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-09-30 | [https://access.redhat.com/errata/RHSA-2019:2925](https://access.redhat.com/errata/RHSA-2019:2925) |
| redhat | Red Hat Security Advisory: rh-nodejs10-nodejs security update | An update for rh-nodejs10-nodejs is now available for Red Hat Software Collections.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-01 | [https://access.redhat.com/errata/RHSA-2019:2939](https://access.redhat.com/errata/RHSA-2019:2939) |
| redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update | An update is now available for JBoss Core Services on RHEL 6 and RHEL 7.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section. | 2019-10-01 | [https://access.redhat.com/errata/RHSA-2019:2946](https://access.redhat.com/errata/RHSA-2019:2946) |
| redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 SP3 security update | Red Hat JBoss Core Services Pack Apache Server 2.4.29 Service Pack 3 packages for RHEL 6, RHEL 7, Microsoft Windows and Oracle Solaris are now available.<br>Red Hat Product Security has rated this release as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-03 | [https://access.redhat.com/errata/RHSA-2019:2950](https://access.redhat.com/errata/RHSA-2019:2950) |
| redhat | Red Hat Security Advisory: rh-nodejs8-nodejs security update | An update for rh-nodejs8-nodejs is now available for Red Hat Software Collections.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-03 | [https://access.redhat.com/errata/RHSA-2019:2955](https://access.redhat.com/errata/RHSA-2019:2955) |
| redhat | Red Hat Security Advisory: Red Hat Quay v3.1.1 security update | Updated Quay packages that fix several bugs and add various enhancements are now available.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-10-05 | [https://access.redhat.com/errata/RHSA-2019:2966](https://access.redhat.com/errata/RHSA-2019:2966) |
| redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 6 | Updated packages that provide Red Hat JBoss Core Services Pack Apache Server 2.4.37 and fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-11-21 | [https://access.redhat.com/errata/RHSA-2019:3932](https://access.redhat.com/errata/RHSA-2019:3932) |
| redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release on RHEL 7 | An update is now available for JBoss Core Services on RHEL 7.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2019-11-21 | [https://access.redhat.com/errata/RHSA-2019:3933](https://access.redhat.com/errata/RHSA-2019:3933) |
| redhat | Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.37 Security Release | Red Hat JBoss Core Services Pack Apache Server 2.4.37 zip release  
for RHEL 6, RHEL 7 and Microsoft Windows is available.<br>Red Hat Product Security has rated this update as having a security impact  
of Important. A Common Vulnerability Scoring System (CVSS) base score,  
which gives a detailed severity rating, is available for each vulnerability  
from the CVE link(s) in the References section. | 2019-11-21 | [https://access.redhat.com/errata/RHSA-2019:3935](https://access.redhat.com/errata/RHSA-2019:3935) |
| redhat | Red Hat Security Advisory: Red Hat AMQ Broker 7.6 release and security update | Red Hat AMQ Broker 7.6 is now available from the Red Hat Customer Portal.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. | 2020-03-23 | [https://access.redhat.com/errata/RHSA-2020:0922](https://access.redhat.com/errata/RHSA-2020:0922) |
| redhat | Red Hat Security Advisory: Red Hat Fuse 7.6.0 security update | A minor version update (from 7.5 to 7.6) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.<br>Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.<br>[2020-04-17 update: descriptions for mutiple components fixed for the same CVE added; also added golang CVE descriptions that were unintentionally ommitted from the original publication] | 2020-03-27 | [https://access.redhat.com/errata/RHSA-2020:0983](https://access.redhat.com/errata/RHSA-2020:0983) |
| fedora | Fedora 29 Update: mod_http2-1.15.3-2.fc29 | Rebuilt with newer nghttp2 | 2019-08-30 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-4427fd65be](https://bodhi.fedoraproject.org/updates/FEDORA-2019-4427fd65be) |
| fedora | Fedora 30 Update: nodejs-10.16.3-1.fc30 | Update to Node.js 10.6.13 | 2019-08-25 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-5a6a7bc12c](https://bodhi.fedoraproject.org/updates/FEDORA-2019-5a6a7bc12c) |
| fedora | Fedora 30 Update: mod_http2-1.15.3-2.fc30 | Rebuilt with newer nghttp2  ----  This update includes the latest upstream  
release of `mod_http2`, version **1.15.3**.  Upstream changes include:  * fixes  
Timeout vs. KeepAliveTimeout behaviour, see PR 63534. * Fixes stream cleanup  
when connection throttling is in place. * Counts stream resets by client on  
streams initiated by client as cause for connection throttling. * Header length  
checks are now logged similar to HTTP/1.1 protocol handler  * Header length is  
checked also on the merged value from several header instances and results in a  
431 response. * fixing mod_proxy_http2 to support trailers in both directions.  
See PR 63502. | 2019-08-31 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-63ba15cc83](https://bodhi.fedoraproject.org/updates/FEDORA-2019-63ba15cc83) |
| fedora | Fedora 29 Update: nodejs-10.16.3-1.fc29 | Update to Node.js 10.6.13 | 2019-08-25 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-6a2980de56](https://bodhi.fedoraproject.org/updates/FEDORA-2019-6a2980de56) |
| fedora | Fedora 29 Update: nginx-1.16.1-1.fc29 | Security fix for CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 | 2020-10-10 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-7a0b45fdc4](https://bodhi.fedoraproject.org/updates/FEDORA-2019-7a0b45fdc4) |
| fedora | Fedora 30 Update: nginx-1.16.1-1.fc30 | Fixes CVE-2019-9511, CVE-2019-9513, CVE-2019-9516 | 2019-08-22 | [https://bodhi.fedoraproject.org/updates/FEDORA-2019-befd924cfe](https://bodhi.fedoraproject.org/updates/FEDORA-2019-befd924cfe) |
| fedora | Fedora 32 Update: nodejs-12.20.1-1.fc32 | Update to 12.20.1 security release | 2021-01-16 | [https://bodhi.fedoraproject.org/updates/FEDORA-2021-d5b2c18fe6](https://bodhi.fedoraproject.org/updates/FEDORA-2021-d5b2c18fe6) |
| apple | APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 |  | 2020-10-10 | [https://lists.apple.com/archives/security-announce/2019/Aug/msg00004.html](https://lists.apple.com/archives/security-announce/2019/Aug/msg00004.html) |
| suse | Security update for nodejs8 | This update for nodejs8 to version 8.16.1 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).<br>Bug fixes:<br>- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).<br>This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html](https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html) |
| suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).<br>This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html](https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html) |
| suse | Security update for nginx | This update for nginx fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
- CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
- CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
- CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015).
- CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022).
- CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025).<br>This update was imported from the SUSE:SLE-15-SP1:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html](https://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html) |
| suse | Security update for nginx | This update for nginx fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
- CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
- CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).<br>This update was imported from the SUSE:SLE-15:Update update project. | 2021-04-16 | [https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html](https://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html) |
| canonical | nginx vulnerabilities | Jonathan Looney discovered that nginx incorrectly handled the HTTP/2  
implementation. A remote attacker could possibly use this issue to consume  
resources, leading to a denial of service. | 2020-07-29 | [https://ubuntu.com/security/notices/USN-4099-1](https://ubuntu.com/security/notices/USN-4099-1) |
| suse | Security update for Mozilla Firefox | This update contains the Mozilla Firefox ESR 68.2 release.<br>Mozilla Firefox was updated to ESR 68.2 release:<br>- Enterprise: New administrative policies were added. More<br>information and templates are available at the Policy  
  Templates page.<br>- Various security fixes:<br>MFSA 2019-33 (bsc#1154738)<br>- CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber
- CVE-2019-11757: Use-after-free when creating index updates in IndexedDB
- CVE-2019-11758: Potentially exploitable crash due to 360 Total Security
- CVE-2019-11759: Stack buffer overflow in HKDF output
- CVE-2019-11760: Stack buffer overflow in WebRTC networking
- CVE-2019-11761: Unintended access to a privileged JSONView object
- CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation
- CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique
- CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2<br>Other Issues resolved:<br>- [bsc#1104841] Newer versions of firefox have a dependency on<br>GLIBCXX_3.4.20<br>- [bsc#1074235] MozillaFirefox: background tab crash reports sent<br>inadvertently without user opt-in<br>- [bsc#1043008] Firefox hangs randomly when browsing and<br>scrolling<br>- [bsc#1025108] Firefox stops loading page until mouse is moved
- [bsc#905528]  Firefox malfunctions due to broken omni.ja<br>archives | 2019-12-12 | [https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/](https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/) |
| suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). | 2019-08-31 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192254-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192254-1/) |
| suse | Security update for nodejs10 | This update for nodejs10 to version 10.16.3 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093). | 2020-09-25 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192259-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192259-1/) |
| suse | Security update for nodejs8 | This update for nodejs8 to version 8.16.1 fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).
- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).
- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).
- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).
- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).<br>Bug fixes:<br>- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919). | 2020-09-25 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192260-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192260-1/) |
| suse | Security update for nginx | This update for nginx fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
- CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
- CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582).
- CVE-2018-16845: Fixed denial of service and memory disclosure via mp4 module (bsc#1115015).
- CVE-2018-16843: Fixed excessive memory consumption in HTTP/2 implementation (bsc#1115022).
- CVE-2018-16844: Fixed excessive CPU usage via flaw in HTTP/2 implementation (bsc#1115025). | 2019-09-06 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192309-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192309-1/) |
| suse | Security update for nginx | This update for nginx fixes the following issues:<br>Security issues fixed:<br>- CVE-2019-9511: Fixed a denial of service by manipulating the window size and stream prioritization (bsc#1145579).
- CVE-2019-9513: Fixed a denial of service caused by resource loops (bsc#1145580).
- CVE-2019-9516: Fixed a denial of service caused by header leaks (bsc#1145582). | 2019-10-05 | [https://www.suse.com/support/update/announcement/2019/suse-su-20192559-1/](https://www.suse.com/support/update/announcement/2019/suse-su-20192559-1/) |
| suse | Security update for nodejs12 | This update for nodejs12 fixes the following issues:<br>Update to LTS release 12.13.0 (jsc#SLE-8947).<br>Security issues fixed:<br>- CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091).
- CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099).
- CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094).
- CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).
- CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100).
- CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).
- CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097).
- CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).
- CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290). | 2020-01-17 | [https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/](https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/) |