CVE-2019-9512: Uncontrolled Resource Consumption

May 24, 2022 (updated February 24, 2023)

Some HTTP/2 implementations is vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

References

github.com/advisories/GHSA-hgr8-6h9x-f7q9
go.dev/cl/190137
go.dev/issue/33606
go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
nvd.nist.gov/vuln/detail/CVE-2019-9512
pkg.go.dev/vuln/GO-2022-0536

Code Behaviors & Features

Detect and mitigate CVE-2019-9512 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →