CVE-2019-9512: Uncontrolled Resource Consumption

May 24, 2022 (updated February 24, 2023)

Some HTTP/2 implementations is vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

References

github.com/advisories/GHSA-hgr8-6h9x-f7q9
go.dev/cl/190137
go.dev/issue/33606
go.googlesource.com/go/+/145e193131eb486077b66009beb051aba07c52a5
groups.google.com/g/golang-announce/c/65QixT3tcmg/m/DrFiG6vvCwAJ
nvd.nist.gov/vuln/detail/CVE-2019-9512
pkg.go.dev/vuln/GO-2022-0536

Code Behaviors & Features

Detect and mitigate CVE-2019-9512 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →