Vulnerability record · CVE-2019-9512 · published 13 August 2019
CVE-2019-9512: HTTP/2 ping flood causes denial of service via resource exhaustion
Apple · Swiftnio
Multiple HTTP/2 implementations mishandle continual PING frames, building an internal queue of responses that consumes excess CPU, memory, or both. This is a remote, unauthenticated denial-of-service condition affecting several vendors' HTTP/2 stacks. The record does not list specific affected version ranges.
Description
Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityNetwork-reachable, unauthenticated denial of service with a high CVSS (7.5) and very high EPSS probability, though not in KEV and with no documented ransomware use.
What it is
Multiple HTTP/2 implementations mishandle continual PING frames, building an internal queue of responses that consumes excess CPU, memory, or both. This is a remote, unauthenticated denial-of-service condition affecting several vendors' HTTP/2 stacks. The record does not list specific affected version ranges.
Impact
An attacker can exhaust server CPU and memory, degrading or halting HTTP/2 service for legitimate users. No data confidentiality or integrity impact is described; the effect is availability loss.
Attack surface
Reachable over the network via the HTTP/2 protocol (CVSS AV:N, AC:L, PR:N, UI:N); no authentication or user interaction is required. Any exposed HTTP/2 endpoint running an unpatched implementation is a candidate target.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.834, 99.7th percentile), indicating elevated likelihood of exploitation activity. Reference tags are advisory and mailing-list only, with no public exploit tag supplied.
What to do
- Patch or upgrade affected HTTP/2 implementations (Apple SwiftNIO, Apache Traffic Server, Node.js, and Debian-packaged components) to vendor-fixed releases.
- Apply the referenced vendor errata (Red Hat, openSUSE) where those distributions are in use.
- Enforce HTTP/2 connection and stream limits, and rate-limit or cap PING frames per connection at the edge or load balancer.
- Monitor and throttle abusive clients; consider temporarily disabling HTTP/2 or falling back to HTTP/1.1 for untrusted traffic if patching is delayed.
Detection
- Alert on abnormal PING frame volume or rate per HTTP/2 connection in server or proxy logs.
- Monitor for sustained CPU and memory spikes correlated with HTTP/2 traffic from single sources.
- Track connection counts and queue growth per client IP to spot ping-flood patterns.
- Review HTTP/2 error and reset (RST_STREAM/GOAWAY) rates for signs of resource-pressure responses.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2019-9512 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-9512), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
