CVE-2019-9514: Allocation of Resources Without Limits or Throttling

May 24, 2022 (updated February 24, 2023)

Some HTTP/2 implementations is vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

References

github.com/advisories/GHSA-39qc-96h7-956f
go.dev/cl/190137
go.dev/issue/33606
go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
nvd.nist.gov/vuln/detail/CVE-2019-9514
pkg.go.dev/vuln/GO-2022-0536

Code Behaviors & Features

Detect and mitigate CVE-2019-9514 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →