CVE-2019-9516: HTTP/2 header leak causes memory exhaustion denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable, low-privilege denial of service with a very high EPSS score and wide product exposure, though no KEV listing or known ransomware use.

What it is

Multiple HTTP/2 implementations mishandle streams of headers with zero-length names and values, allocating memory that stays alive until the session ends. An attacker can repeatedly send such headers to exhaust server memory and cause a denial of service. The flaw affects a broad set of HTTP/2 servers and libraries across many vendors.

Impact

An attacker can drive uncontrolled memory consumption on the target HTTP/2 endpoint, degrading or halting service for legitimate users. No data confidentiality or integrity impact is described; the effect is availability loss.

Attack surface

Reachable over the network via HTTP/2 (CVSS AV:N) with low privileges required (PR:L) and no user interaction (UI:N). Any client able to open an HTTP/2 session and send headers can attempt it.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is high (0.56262, 99th percentile), indicating elevated likelihood of exploitation activity. References are vendor advisories and third-party bulletins rather than public exploit code.

What to do

• Apply vendor patches for affected HTTP/2 implementations (Red Hat, Fedora, openSUSE, Debian, Ubuntu, Apache, nginx, Node.js, F5, McAfee, Synology and others) as listed in the referenced advisories.
• Upgrade or replace HTTP/2 stacks that cannot be patched, or disable HTTP/2 where it is not required.
• Enforce header size and count limits at the HTTP/2 layer and reject zero-length header names or values.
• Cap per-connection and per-session memory usage and set connection timeouts to bound resource retention.
• Monitor memory growth per HTTP/2 connection and rate-limit or drop abusive clients.

Detection

• Alert on sustained memory growth correlated with a single HTTP/2 connection or client.
• Inspect HTTP/2 traffic for streams containing zero-length header names or values.
• Track connection counts and header rates per source IP for anomalies.
• Review HTTP/2 server logs for session resets or errors tied to header processing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.