CVE-2019-9513: HTTP/2 implementations vulnerable to CPU exhaustion via stream priority churn

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityCVSS is 7.5 (high) with network reachability and no authentication, and EPSS is very high, though KEV does not list it and no public exploit is confirmed in the record.

What it is

Some HTTP/2 implementations mishandle rapid changes to stream priorities, allowing an attacker to create multiple request streams and continually shuffle their priority, causing excessive churn in the priority tree. This uncontrolled resource consumption can drive up CPU usage and lead to denial of service. The flaw affects a broad set of HTTP/2 servers and libraries across many vendors.

Impact

An attacker can consume excess CPU on the target server, degrading or denying service to legitimate users. There is no confidentiality or integrity impact; the effect is availability loss.

Attack surface

The flaw is reachable over the network via HTTP/2 traffic; the CVSS vector shows no privileges or user interaction required. Any exposed HTTP/2 endpoint that does not limit priority churn is potentially reachable.

Exploitation

CVE-2019-9513 is not listed in CISA KEV, but EPSS is very high (0.81556, 99.6th percentile), indicating elevated likelihood of exploitation activity. References are vendor advisories and third-party bulletins, with no public exploit tag in the record.

What to do

• Apply vendor patches or updates for affected HTTP/2 implementations as soon as they are available.
• Disable HTTP/2 if it is not required, or restrict it to trusted networks until patched.
• Configure HTTP/2 server limits on concurrent streams and priority changes where the implementation supports it.
• Monitor CPU usage and HTTP/2 stream behavior for anomalies that could indicate priority-churn abuse.
• Review vendor advisories for the specific products in use and confirm which versions are affected.

Detection

• Monitor HTTP/2 servers for sustained high CPU usage correlated with many concurrent streams.
• Look for abnormal patterns of stream priority changes or rapid stream creation and reset in HTTP/2 traffic.
• Alert on HTTP/2 connection counts or stream churn exceeding normal baselines for the service.
• Review server logs for repeated HTTP/2 protocol errors or resource exhaustion events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.