CVE-2019-9515: HTTP/2 SETTINGS frame flood causes denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with network, no-auth, no-interaction reachability and a very high EPSS score make this a serious availability threat despite no KEV listing.

What it is

Multiple HTTP/2 implementations mishandle a flood of SETTINGS frames, since the RFC requires one acknowledgement per frame, making an empty SETTINGS frame behave like a ping. An attacker can send a continuous stream of these frames to exhaust CPU, memory, or both, degrading or halting the service. The flaw is a resource-consumption issue tracked as CWE-400 and CWE-770.

Impact

An unauthenticated remote attacker can consume server CPU and memory, causing denial of service for legitimate HTTP/2 clients. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via the HTTP/2 protocol (CVSS vector AV:N/AC:L/PR:N/UI:N), requiring no authentication and no user interaction. Any exposed HTTP/2 endpoint on an affected implementation is a candidate target.

Exploitation

Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.874 probability, 99.7th percentile), indicating elevated predicted exploitation activity. References are advisory and vendor errata only, with no public exploit tag supplied.

What to do

• Apply vendor patches or errata for affected HTTP/2 implementations (Red Hat, Apache Traffic Server, Node.js, F5, and others listed in the references) as the first step.
• Where patching is not immediate, rate-limit or cap concurrent SETTINGS frames and pending acknowledgements per connection.
• Enforce connection and stream limits, and set timeouts that close connections generating excessive control frames.
• Place HTTP/2 endpoints behind a proxy or load balancer that can absorb or filter abusive frame patterns.
• Monitor and alert on abnormal SETTINGS frame rates per client to trigger throttling.

Detection

• Baseline normal SETTINGS frame rates per connection and alert on sustained high volumes from a single client.
• Track CPU and memory spikes correlated with HTTP/2 control-frame traffic on servers.
• Log and review connections that repeatedly send empty SETTINGS frames or trigger excessive acknowledgement queues.
• Watch for connection churn or timeouts concentrated on HTTP/2 listeners during suspected floods.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.