Every CVE Search/ Get API key

CVE-2019-9512

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

7.5 HighFix available

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

83.4%Up 76.2 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
CVE-2019-9512
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2022-4147 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
EUVD-2022-4147
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-hgr8-6h9x-f7q9 7.5

golang.org/x/net/http vulnerable to ping floods

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Specific Go Packages Affected

golang.org/x/net/http2

Record
GHSA-hgr8-6h9x-f7q9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
CVE-2019-9512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
7.8 HighAV:N/AC:L/Au:N/C:N/I:N/A:C
Weakness
CWE-400
Updated
2026-11-02
OSVALPINE-CVE-2019-9512 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
ALPINE-CVE-2019-9512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
OSVAZL-38449 7.5

CVE-2019-9512 affecting package python-tensorboard for versions less than 2.16.2-1

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
AZL-38449
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 44 moreShow less
OSVBELL-CVE-2019-9512 7.5

CVE-2019-9512 does not affect BellSoft software

Record
BELL-CVE-2019-9512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
CVE-2019-9512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCVE-2019-9514 7.5

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Record
CVE-2019-9514
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-9512 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
DEBIAN-CVE-2019-9512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-39qc-96h7-956f 7.5

golang.org/x/net/http vulnerable to a reset flood

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Specific Go Packages Affected

golang.org/x/net/http2

Record
GHSA-39qc-96h7-956f
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-770
Updated
2026-11-02
OSVGHSA-hgr8-6h9x-f7q9 7.5

golang.org/x/net/http vulnerable to ping floods

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Specific Go Packages Affected

golang.org/x/net/http2

Record
GHSA-hgr8-6h9x-f7q9
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVRHBA-2019:2819 7.5

Red Hat Bug Fix Advisory: OpenShift Container Platform 4.1.17 packages update

Record
RHBA-2019:2819
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHBA-2019:3139 7.5

Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11 bug fix and enhancement update

Record
RHBA-2019:3139
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2661 7.5

Red Hat Security Advisory: Red Hat OpenShift Container Platform 4.1 openshift RPM security update

Record
RHSA-2019:2661
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2682 7.5

Red Hat Security Advisory: go-toolset-1.11 and go-toolset-1.11-golang security update

Record
RHSA-2019:2682
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2690 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.10 security update

Record
RHSA-2019:2690
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2726 7.5

Red Hat Security Advisory: go-toolset:rhel8 security and bug fix update

Record
RHSA-2019:2726
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2769 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.9 security update

Record
RHSA-2019:2769
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2796 7.5

Red Hat Security Advisory: skydive security update

Record
RHSA-2019:2796
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2817 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.11 security update

Record
RHSA-2019:2817
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2925 7.5

Red Hat Security Advisory: nodejs:10 security update

Record
RHSA-2019:2925
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2939 7.5

Red Hat Security Advisory: rh-nodejs10-nodejs security update

Record
RHSA-2019:2939
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:2955 7.5

Red Hat Security Advisory: rh-nodejs8-nodejs security update

Record
RHSA-2019:2955
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:3131 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.1.20 golang security update

Record
RHSA-2019:3131
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:3245 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.2 security update

Record
RHSA-2019:3245
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:3265 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.1 security update

Record
RHSA-2019:3265
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:3906 7.5

Red Hat Security Advisory: OpenShift Container Platform 3.11 HTTP/2 security update

Record
RHSA-2019:3906
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:4018 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 6 security update

Record
RHSA-2019:4018
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:4019 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 7 security update

Record
RHSA-2019:4019
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:4020 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.5 on RHEL 8 security update

Record
RHSA-2019:4020
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:4040 9.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 6

Record
RHSA-2019:4040
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:4041 9.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 7

Record
RHSA-2019:4041
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:4042 9.1

Red Hat Security Advisory: Red Hat Single Sign-On 7.3.5 security update on RHEL 8

Record
RHSA-2019:4042
CVSS 3.0
9.1 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:4269 7.5

Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

Record
RHSA-2019:4269
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2019:4273 7.5

Red Hat Security Advisory: container-tools:1.0 security update

Record
RHSA-2019:4273
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2020:0406 7.5

Red Hat Security Advisory: containernetworking-plugins security update

Record
RHSA-2020:0406
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:5856 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.7 on RHEL 7 security update

Record
RHSA-2024:5856
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2019:2925 7.5

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

  • HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  • HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  • HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  • HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  • HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2019:2925
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2019:4269 7.5

Important: container-tools:rhel8 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  • runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

  • backport json-file logging support to 1.4.2 (BZ#1770176)

  • Selinux won't allow SCTP inter pod communication (BZ#1774382)

Record
RLSA-2019:4269
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2019:4273 7.5

Important: container-tools:1.0 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2019:4273
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-9512 7.5

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Record
UBUNTU-CVE-2019-9512
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2019:2925 No score

Important: nodejs:10 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.

The following packages have been upgraded to a later upstream version: nodejs (10.16.3).

Security Fix(es):

  • HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)

  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  • HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  • HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)

  • HTTP/2: request for large response leads to denial of service (CVE-2019-9517)

  • HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2019:2925
Updated
2026-11-02
OSVALSA-2019:4269 No score

Important: container-tools:rhel8 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  • runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)

  • backport json-file logging support to 1.4.2 (BZ#1770176)

  • Selinux won't allow SCTP inter pod communication (BZ#1774382)

Record
ALSA-2019:4269
Updated
2026-11-02
OSVALSA-2019:4273 No score

Important: container-tools:1.0 security update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2019:4273
Updated
2026-11-02
OSVGO-2022-0536 No score

Reset flood in net/http and golang.org/x/net/http

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service.

Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Record
GO-2022-0536
Updated
2026-11-02
OSVMGASA-2019-0251 No score

Updated golang packages fix security vulnerabilities

Updated golang packages fix security vulnerabilities:

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both (CVE-2019-9512)

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both (CVE-2019-9514).

net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This is related to a Host field with a suffix appearing in neither Hostname() nor Port(), and is related to a non-numeric port number. (CVE-2019-14809)

Record
MGASA-2019-0251
Updated
2026-11-02
OSVMGASA-2020-0372 No score

Updated nodejs packages fix security vulnerabilities

The nodejs package has been updated to the latest version in the 10.x branch, which is 10.22.1 at this time. It fixes several security issues and other bugs. See the upstream changelog and advisories for details.

Record
MGASA-2020-0372
Updated
2026-11-02
OSVMGASA-2020-0468 No score

Updated golang-googlecode-net package fixes security vulnerabilities

This code was vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both (CVE-2019-9512).

This code was vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both (CVE-2019-9514).

Record
MGASA-2020-0468
Updated
2026-11-02
OSVopenSUSE-SU-2019:2000-1 No score

Security update for go1.12

This update for go1.12 fixes the following issues:

Security issues fixed:

  • CVE-2019-9512: Fixed HTTP/2 flood using PING frames that results in unbounded memory growth. (bsc#1146111)
  • CVE-2019-9514: Fixed HTTP/2 implementation is vulnerable to a reset flood, potentially leading to a denial of service. (bsc#1146115)
  • CVE-2019-14809: Fixed authorization bypass due to malformed hosts in URLs. (bsc#1146123)
Record
openSUSE-SU-2019:2000-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
golang.org/x/net
Go
 before 0.0.0-20190813141303-74dc4d7220e7
0.0.0-20190813141303-74dc4d7220e7
containerd
Alpine:v3.10
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.11
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.12
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.13
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.14
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.15
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.16
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.17
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.18
 before 1.2.9-r0
1.2.9-r0
Show 290 moreShow less
Affected packages
PackageAffectedFixed
containerd
Alpine:v3.19
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.20
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.21
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.22
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.23
 before 1.2.9-r0
1.2.9-r0
containerd
Alpine:v3.24
 before 1.2.9-r0
1.2.9-r0
go
Alpine:v3.10
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.11
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.12
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.13
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.14
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.15
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.16
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.17
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.18
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.19
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.20
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.21
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.22
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.23
 before 1.12.8-r0
1.12.8-r0
go
Alpine:v3.24
 before 1.12.8-r0
1.12.8-r0
h2o
Alpine:v3.11
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.12
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.13
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.14
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.15
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.16
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.17
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.18
 before 2.2.6-r0
2.2.6-r0
h2o
Alpine:v3.19
 before 2.2.6-r0
2.2.6-r0
k3s
Alpine:v3.13
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.14
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.15
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.16
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.17
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.18
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.19
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.20
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.21
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.22
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.23
 before 0.8.1-r0
0.8.1-r0
k3s
Alpine:v3.24
 before 0.8.1-r0
0.8.1-r0
nodejs
Alpine:v3.10
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.11
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.12
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.13
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.14
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.15
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.16
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.17
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.18
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.19
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.20
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.21
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.22
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.23
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.24
 before 10.16.3-r0
10.16.3-r0
nodejs
Alpine:v3.9
 before 10.16.3-r0
10.16.3-r0
py3-twisted
Alpine:v3.11
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.12
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.13
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.14
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.15
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.16
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.17
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.18
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.19
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.20
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.21
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.22
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.23
 before 19.10.0-r0
19.10.0-r0
py3-twisted
Alpine:v3.24
 before 19.10.0-r0
19.10.0-r0
nodejs-nodemon
AlmaLinux:8
 before 1.18.3-1.module_el8.3.0+2023+d2377ea3
1.18.3-1.module_el8.3.0+2023+d2377ea3
nodejs-nodemon
AlmaLinux:8
 before 1.18.3-1.module_el8.3.0+2047+b07ac28e
1.18.3-1.module_el8.3.0+2047+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2224+b07ac28e
17-3.module_el8.4.0+2224+b07ac28e
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.4.0+2521+c668cc9f
17-3.module_el8.4.0+2521+c668cc9f
nodejs-packaging
AlmaLinux:8
 before 17-3.module_el8.3.0+2023+d2377ea3
17-3.module_el8.3.0+2023+d2377ea3
oci-systemd-hook
AlmaLinux:8
 before 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
oci-systemd-hook
AlmaLinux:8
 before 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
oci-systemd-hook
AlmaLinux:8
 before 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
oci-umount
AlmaLinux:8
 before 2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082
oci-umount
AlmaLinux:8
 before 2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43
oci-umount
AlmaLinux:8
 before 2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43
containernetworking-plugins
AlmaLinux:8
 before 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43
0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43
containernetworking-plugins
AlmaLinux:8
 before 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43
0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43
containernetworking-plugins
AlmaLinux:8
 before 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082
0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082
containers-common
AlmaLinux:8
 before 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
containers-common
AlmaLinux:8
 before 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
containers-common
AlmaLinux:8
 before 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
fuse-overlayfs
AlmaLinux:8
 before 0.3-5.module_el8.3.0+2044+12421f43
0.3-5.module_el8.3.0+2044+12421f43
fuse-overlayfs
AlmaLinux:8
 before 0.3-5.module_el8.4.0+2496+12421f43
0.3-5.module_el8.4.0+2496+12421f43
fuse-overlayfs
AlmaLinux:8
 before 0.3-5.module_el8.5.0+119+9a9ec082
0.3-5.module_el8.5.0+119+9a9ec082
runc
AlmaLinux:8
 before 1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43
1.0.0-56.rc5.dev.git2abd837.module_el8.3.0+2044+12421f43
runc
AlmaLinux:8
 before 1.0.0-56.rc5.dev.git2abd837.module_el8.4.0+2496+12421f43
1.0.0-56.rc5.dev.git2abd837.module_el8.4.0+2496+12421f43
runc
AlmaLinux:8
 before 1.0.0-56.rc5.dev.git2abd837.module_el8.5.0+119+9a9ec082
1.0.0-56.rc5.dev.git2abd837.module_el8.5.0+119+9a9ec082
skopeo
AlmaLinux:8
 before 1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
1:0.1.32-6.git1715c90.module_el8.4.0+2496+12421f43
skopeo
AlmaLinux:8
 before 1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
1:0.1.32-6.git1715c90.module_el8.5.0+119+9a9ec082
skopeo
AlmaLinux:8
 before 1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
1:0.1.32-6.git1715c90.module_el8.4.0+2478+12421f43
python-tensorboard
Azure Linux:3
 before 2.16.2-1
2.16.2-1
h2o
Debian:12
 before 2.2.5+dfsg2-3
2.2.5+dfsg2-3
trafficserver
Debian:12
 before 8.0.5+ds-1
8.0.5+ds-1
golang-golang-x-net-dev
Debian:9
 before 1:0.0+git20161013.8b4af36+dfsg-3+deb9u1, plus listed versions
1:0.0+git20161013.8b4af36+dfsg-3
1:0.0+git20161013.8b4af36+dfsg-3+deb9u1
golang-1.11
Debian:10
 before 1.11.6-1+deb10u1, plus listed versions
1.11.6-1
1.11.6-1+deb10u1
h2o
Debian:10
 before 2.2.5+dfsg2-2+deb10u1, plus listed versions
2.2.5+dfsg2-2
2.2.5+dfsg2-2+deb10u1
trafficserver
Debian:10
 before 8.0.2+ds-1+deb10u1, plus listed versions
8.0.2+ds-1
8.0.2+ds-1+deb10u1
stdlib
Go
 before 1.11.13, 1.12.0-0 up to 1.12.8
1.11.131.12.8
golang
Mageia:6
 before 1.11.13-1.mga6
1.11.13-1.mga6
golang
Mageia:7
 before 1.12.8-1.mga7
1.12.8-1.mga7
libuv
Mageia:7
 before 1.34.2-1.mga7
1.34.2-1.mga7
nodejs
Mageia:7
 before 10.22.1-9.mga7
10.22.1-9.mga7
golang-googlecode-net
Mageia:7
 before 0-0.3.mga7
0-0.3.mga7
ansible-service-broker
Red Hat:openshift:4.1::el7
 before 1:1.4.4-2.el7
1:1.4.4-2.el7
ansible-service-broker-container-scripts
Red Hat:openshift:4.1::el7
 before 1:1.4.4-2.el7
1:1.4.4-2.el7
ansible-service-broker-selinux
Red Hat:openshift:4.1::el7
 before 1:1.4.4-2.el7
1:1.4.4-2.el7
automation-broker-apb-role
Red Hat:openshift:4.1::el7
 before 1:1.4.4-2.el7
1:1.4.4-2.el7
apb
Red Hat:openshift:3.11::el7
 before 0:1.9.8-1.el7
0:1.9.8-1.el7
apb-container-scripts
Red Hat:openshift:3.11::el7
 before 0:1.9.8-1.el7
0:1.9.8-1.el7
apb-devel
Red Hat:openshift:3.11::el7
 before 0:1.9.8-1.el7
0:1.9.8-1.el7
atomic-openshift
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-clients
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-excluder
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-hyperkube
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-hypershift
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-master
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-node
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-pod
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
atomic-openshift-tests
Red Hat:openshift:3.11::el7
 before 0:3.11.153-1.git.0.aaf3f71.el7
0:3.11.153-1.git.0.aaf3f71.el7
cri-tools
Red Hat:openshift:3.11::el7
 before 0:1.11.1-2.rhaos3.11.gitedabfb5.el7
0:1.11.1-2.rhaos3.11.gitedabfb5.el7
cri-tools-debuginfo
Red Hat:openshift:3.11::el7
 before 0:1.11.1-2.rhaos3.11.gitedabfb5.el7
0:1.11.1-2.rhaos3.11.gitedabfb5.el7
openshift-monitor-project-lifecycle
Red Hat:openshift:3.11::el7
 before 0:3.11.51-2.git.59.7b59e29.el7
0:3.11.51-2.git.59.7b59e29.el7
atomic-enterprise-service-catalog
Red Hat:openshift:4.1::el7
 before 1:4.1.14-201908290858.git.1.28cc9ff.el7
1:4.1.14-201908290858.git.1.28cc9ff.el7
atomic-enterprise-service-catalog-svcat
Red Hat:openshift:4.1::el7
 before 1:4.1.14-201908290858.git.1.28cc9ff.el7
1:4.1.14-201908290858.git.1.28cc9ff.el7
openshift
Red Hat:openshift:4.1::el7
 before 0:4.1.14-201908290858.git.0.3bd3467.el7
0:4.1.14-201908290858.git.0.3bd3467.el7
openshift-clients
Red Hat:openshift:4.1::el7
 before 0:4.1.14-201908290858.git.0.3bd3467.el7
0:4.1.14-201908290858.git.0.3bd3467.el7
openshift-clients-redistributable
Red Hat:openshift:4.1::el7
 before 0:4.1.14-201908290858.git.0.3bd3467.el7
0:4.1.14-201908290858.git.0.3bd3467.el7
openshift-hyperkube
Red Hat:openshift:4.1::el7
 before 0:4.1.14-201908290858.git.0.3bd3467.el7
0:4.1.14-201908290858.git.0.3bd3467.el7
openshift
Red Hat:openshift:4.1::el8
 before 0:4.1.14-201908290858.git.0.3bd3467.el8
0:4.1.14-201908290858.git.0.3bd3467.el8
openshift-clients
Red Hat:openshift:4.1::el8
 before 0:4.1.14-201908290858.git.0.3bd3467.el8
0:4.1.14-201908290858.git.0.3bd3467.el8
openshift-clients-redistributable
Red Hat:openshift:4.1::el8
 before 0:4.1.14-201908290858.git.0.3bd3467.el8
0:4.1.14-201908290858.git.0.3bd3467.el8
openshift-hyperkube
Red Hat:openshift:4.1::el8
 before 0:4.1.14-201908290858.git.0.3bd3467.el8
0:4.1.14-201908290858.git.0.3bd3467.el8
go-toolset-1.11
Red Hat:devtools:2019
 before 0:1.11.13-1.el7
0:1.11.13-1.el7
go-toolset-1.11-build
Red Hat:devtools:2019
 before 0:1.11.13-1.el7
0:1.11.13-1.el7
go-toolset-1.11-golang
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
go-toolset-1.11-golang-bin
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
go-toolset-1.11-golang-docs
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
go-toolset-1.11-golang-misc
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
go-toolset-1.11-golang-src
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
go-toolset-1.11-golang-tests
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
go-toolset-1.11-runtime
Red Hat:devtools:2019
 before 0:1.11.13-1.el7
0:1.11.13-1.el7
go-toolset-1.11-scldevel
Red Hat:devtools:2019
 before 0:1.11.13-1.el7
0:1.11.13-1.el7
go-toolset-1.11-golang-race
Red Hat:devtools:2019
 before 0:1.11.13-2.el7
0:1.11.13-2.el7
atomic-openshift
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-clients
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-excluder
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-hyperkube
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-hypershift
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-master
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-node
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-pod
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
atomic-openshift-tests
Red Hat:openshift:3.10::el7
 before 0:3.10.170-1.git.0.8e592d6.el7
0:3.10.170-1.git.0.8e592d6.el7
go-toolset
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-1.module+el8.0.1+4087+d8180914
0:1.11.13-1.module+el8.0.1+4087+d8180914
golang
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
golang-bin
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
golang-docs
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
golang-misc
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
golang-race
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
golang-src
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
golang-tests
Red Hat:enterprise_linux:8::appstream
 before 0:1.11.13-2.module+el8.0.1+4087+d8180914
0:1.11.13-2.module+el8.0.1+4087+d8180914
ansible-service-broker
Red Hat:openshift:3.9::el7
 before 0:1.1.20-2.el7
0:1.1.20-2.el7
ansible-service-broker-container-scripts
Red Hat:openshift:3.9::el7
 before 0:1.1.20-2.el7
0:1.1.20-2.el7
ansible-service-broker-selinux
Red Hat:openshift:3.9::el7
 before 0:1.1.20-2.el7
0:1.1.20-2.el7
atomic-openshift
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-clients
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-clients-redistributable
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-cluster-capacity
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-descheduler
Red Hat:openshift:3.9::el7
 before 0:3.9.13-2.git.267.bb59a3f.el7
0:3.9.13-2.git.267.bb59a3f.el7
atomic-openshift-docker-excluder
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-dockerregistry
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.1.13625cf.el7
0:3.9.101-1.git.1.13625cf.el7
atomic-openshift-excluder
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-federation-services
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-master
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-node
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-node-problem-detector
Red Hat:openshift:3.9::el7
 before 0:3.9.13-2.git.167.5d6b0d4.el7
0:3.9.13-2.git.167.5d6b0d4.el7
atomic-openshift-pod
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-sdn-ovs
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-service-catalog
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-template-service-broker
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-tests
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.0.150f595.el7
0:3.9.101-1.git.0.150f595.el7
atomic-openshift-web-console
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.1.601c6d2.el7
0:3.9.101-1.git.1.601c6d2.el7
cockpit
Red Hat:openshift:3.9::el7
 before 0:195-2.rhaos.el7
0:195-2.rhaos.el7
cockpit-debuginfo
Red Hat:openshift:3.9::el7
 before 0:195-2.rhaos.el7
0:195-2.rhaos.el7
cockpit-kubernetes
Red Hat:openshift:3.9::el7
 before 0:195-2.rhaos.el7
0:195-2.rhaos.el7
containernetworking-plugins
Red Hat:openshift:3.9::el7
 before 0:0.5.2-6.el7
0:0.5.2-6.el7
containernetworking-plugins-debuginfo
Red Hat:openshift:3.9::el7
 before 0:0.5.2-6.el7
0:0.5.2-6.el7
cri-o
Red Hat:openshift:3.9::el7
 before 0:1.9.16-3.git858756d.el7
0:1.9.16-3.git858756d.el7
cri-o-debuginfo
Red Hat:openshift:3.9::el7
 before 0:1.9.16-3.git858756d.el7
0:1.9.16-3.git858756d.el7
cri-tools
Red Hat:openshift:3.9::el7
 before 0:1.0.0-6.rhaos3.9.git8e6013a.el7
0:1.0.0-6.rhaos3.9.git8e6013a.el7
cri-tools-debuginfo
Red Hat:openshift:3.9::el7
 before 0:1.0.0-6.rhaos3.9.git8e6013a.el7
0:1.0.0-6.rhaos3.9.git8e6013a.el7
golang-github-openshift-oauth-proxy
Red Hat:openshift:3.9::el7
 before 0:2.1-3.git885c9f40.el7
0:2.1-3.git885c9f40.el7
golang-github-openshift-prometheus-alert-buffer
Red Hat:openshift:3.9::el7
 before 0:0-3.gitceca8c1.el7
0:0-3.gitceca8c1.el7
golang-github-prometheus-alertmanager
Red Hat:openshift:3.9::el7
 before 0:0.14.0-2.git30af4d0.el7
0:0.14.0-2.git30af4d0.el7
golang-github-prometheus-node_exporter
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.1.8295224.el7
0:3.9.101-1.git.1.8295224.el7
golang-github-prometheus-prometheus
Red Hat:openshift:3.9::el7
 before 0:2.2.1-2.gitbc6058c.el7
0:2.2.1-2.gitbc6058c.el7
golang-github-prometheus-promu
Red Hat:openshift:3.9::el7
 before 0:0-5.git85ceabc.el7
0:0-5.git85ceabc.el7
hawkular-openshift-agent
Red Hat:openshift:3.9::el7
 before 0:1.2.2-3.el7
0:1.2.2-3.el7
heapster
Red Hat:openshift:3.9::el7
 before 0:1.3.0-4.el7
0:1.3.0-4.el7
image-inspector
Red Hat:openshift:3.9::el7
 before 0:2.1.3-2.el7
0:2.1.3-2.el7
openshift-enterprise-image-registry
Red Hat:openshift:3.9::el7
 before 0:3.8.0-2.git.216.b6b90bb.el7
0:3.8.0-2.git.216.b6b90bb.el7
openshift-eventrouter
Red Hat:openshift:3.9::el7
 before 0:0.1-3.git5bd9251.el7
0:0.1-3.git5bd9251.el7
openshift-eventrouter-debuginfo
Red Hat:openshift:3.9::el7
 before 0:0.1-3.git5bd9251.el7
0:0.1-3.git5bd9251.el7
openshift-external-storage
Red Hat:openshift:3.9::el7
 before 0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
openshift-external-storage-debuginfo
Red Hat:openshift:3.9::el7
 before 0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
openshift-external-storage-efs-provisioner
Red Hat:openshift:3.9::el7
 before 0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
openshift-external-storage-local-provisioner
Red Hat:openshift:3.9::el7
 before 0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
openshift-external-storage-snapshot-controller
Red Hat:openshift:3.9::el7
 before 0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
openshift-external-storage-snapshot-provisioner
Red Hat:openshift:3.9::el7
 before 0:0.0.1-9.git78d6339.el7
0:0.0.1-9.git78d6339.el7
openvswitch-ovn-kubernetes
Red Hat:openshift:3.9::el7
 before 0:0.1.0-3.el7
0:0.1.0-3.el7
prometheus
Red Hat:openshift:3.9::el7
 before 0:2.2.1-2.gitbc6058c.el7
0:2.2.1-2.gitbc6058c.el7
prometheus-alertmanager
Red Hat:openshift:3.9::el7
 before 0:0.14.0-2.git30af4d0.el7
0:0.14.0-2.git30af4d0.el7
prometheus-node-exporter
Red Hat:openshift:3.9::el7
 before 0:3.9.101-1.git.1.8295224.el7
0:3.9.101-1.git.1.8295224.el7
prometheus-promu
Red Hat:openshift:3.9::el7
 before 0:0-5.git85ceabc.el7
0:0-5.git85ceabc.el7
skydive
Red Hat:openstack:14::el7
 before 0:0.20.5-2.el7ost
0:0.20.5-2.el7ost
skydive-agent
Red Hat:openstack:14::el7
 before 0:0.20.5-2.el7ost
0:0.20.5-2.el7ost
nodejs-nodemon
Rocky Linux:8
 before 0:1.18.3-1.module+el8.3.0+101+f84c7154
0:1.18.3-1.module+el8.3.0+101+f84c7154
nodejs-packaging
Rocky Linux:8
 before 0:17-3.module+el8.3.0+101+f84c7154
0:17-3.module+el8.3.0+101+f84c7154
oci-systemd-hook
Rocky Linux:8
 before 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f
1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f
oci-umount
Rocky Linux:8
 before 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f
fuse-overlayfs
Rocky Linux:8
 before 0:0.3-5.module+el8.5.0+681+c9a1951f
0:0.3-5.module+el8.5.0+681+c9a1951f
fuse-overlayfs
Rocky Linux:8
 before 0:0.3-5.module+el8.4.0+557+48ba8b2f
0:0.3-5.module+el8.4.0+557+48ba8b2f
containernetworking-plugins
Rocky Linux:8
 before 0:0.7.4-4.git9ebe139.module+el8.5.0+681+c9a1951f
0:0.7.4-4.git9ebe139.module+el8.5.0+681+c9a1951f
containernetworking-plugins
Rocky Linux:8
 before 0:0.7.4-4.git9ebe139.module+el8.4.0+557+48ba8b2f
0:0.7.4-4.git9ebe139.module+el8.4.0+557+48ba8b2f
runc
Rocky Linux:8
 before 0:1.0.0-56.rc5.dev.git2abd837.module+el8.5.0+681+c9a1951f
0:1.0.0-56.rc5.dev.git2abd837.module+el8.5.0+681+c9a1951f
runc
Rocky Linux:8
 before 0:1.0.0-56.rc5.dev.git2abd837.module+el8.4.0+557+48ba8b2f
0:1.0.0-56.rc5.dev.git2abd837.module+el8.4.0+557+48ba8b2f
skopeo
Rocky Linux:8
 before 1:0.1.32-6.git1715c90.module+el8.5.0+681+c9a1951f
1:0.1.32-6.git1715c90.module+el8.5.0+681+c9a1951f
skopeo
Rocky Linux:8
 before 1:0.1.32-6.git1715c90.module+el8.4.0+557+48ba8b2f
1:0.1.32-6.git1715c90.module+el8.4.0+557+48ba8b2f
MozillaFirefox
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 68.2.0-78.51.4
68.2.0-78.51.4
MozillaFirefox-branding-SLED
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 68-21.9.8
68-21.9.8
firefox-atk
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.26.1-2.8.4
2.26.1-2.8.4
firefox-cairo
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.15.10-2.13.4
1.15.10-2.13.4
firefox-gdk-pixbuf
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.36.11-2.8.4
2.36.11-2.8.4
firefox-glib2
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 2.54.3-2.14.7
2.54.3-2.14.7
firefox-gtk3
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.10.9-2.15.3
3.10.9-2.15.3
firefox-harfbuzz
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.7.5-2.7.4
1.7.5-2.7.4
firefox-libffi
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.2.1.git259-2.3.3
3.2.1.git259-2.3.3
firefox-libffi-gcc5
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 5.3.1+r233831-14.1
5.3.1+r233831-14.1
firefox-pango
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 1.40.14-2.7.4
1.40.14-2.7.4
mozilla-nspr
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 4.21-29.6.1
4.21-29.6.1
mozilla-nss
SUSE:Linux Enterprise Server 11 SP4-LTSS
 before 3.45-38.9.3
3.45-38.9.3
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 10.16.3-1.12.1
10.16.3-1.12.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15
 before 10.16.3-1.12.1
10.16.3-1.12.1
nodejs10
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
 before 10.16.3-1.12.1
10.16.3-1.12.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15
 before 8.16.1-3.20.1
8.16.1-3.20.1
nodejs8
SUSE:Linux Enterprise Module for Web and Scripting 15 SP1
 before 8.16.1-3.20.1
8.16.1-3.20.1
nodejs12
SUSE:Linux Enterprise Module for Web and Scripting 12
 before 12.13.0-1.3.1
12.13.0-1.3.1
golang-1.10
Ubuntu:14.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~14.04.1
 None known
golang-1.10
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.10.4-2ubuntu1~16.04.11.10.4-2ubuntu1~16.04.2
 None known
golang-1.6
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.6-0ubuntu11.6-0ubuntu21.6-0ubuntu31.6-0ubuntu41.6-0ubuntu5
Show 5 moreShow less
1.6.1-0ubuntu11.6.2-0ubuntu5~16.041.6.2-0ubuntu5~16.04.21.6.2-0ubuntu5~16.04.31.6.2-0ubuntu5~16.04.4
 None known
trafficserver
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.3.0-2ubuntu15.3.0-2ubuntu2
 None known
twisted
Ubuntu:18.04:LTS
 before 17.9.0-2ubuntu0.1, plus listed versions
16.6.0-2ubuntu317.9.0-117.9.0-2
17.9.0-2ubuntu0.1
golang-1.10
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.10~rc1-11.10~rc1-1ubuntu11.10~rc1-2ubuntu11.10~rc2-1ubuntu11.10-1ubuntu11.10.1-1ubuntu21.10.4-2ubuntu1~18.04.11.10.4-2ubuntu1~18.04.2
 None known
golang-1.8
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.8.3-2ubuntu11.8.3-2ubuntu1.18.04.1
 None known
golang-1.9
Ubuntu:18.04:LTS
 All versions, plus listed versions
1.9.1-2ubuntu11.9.2-1ubuntu11.9.2-3ubuntu11.9.3-1ubuntu11.9.4-1ubuntu1
 None known
h2o
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2.2.3+dfsg-22.2.4+dfsg-12.2.4+dfsg-1build12.2.4+dfsg-1ubuntu0.1~esm2
 None known
netty
Ubuntu:Pro:18.04:LTS
 before 1:4.1.7-4ubuntu0.1+esm1, plus listed versions
1:4.1.7-41:4.1.7-4ubuntu0.1~esm11:4.1.7-4ubuntu0.1
1:4.1.7-4ubuntu0.1+esm1
trafficserver
Ubuntu:18.04:LTS
 All versions, plus listed versions
7.0.0-57.1.2+ds-27.1.2+ds-2build17.1.2+ds-3
 None known
twisted
Ubuntu:20.04:LTS
 before 18.9.0-6ubuntu1, plus listed versions
18.9.0-3ubuntu118.9.0-518.9.0-618.9.0-6build1
18.9.0-6ubuntu1
twisted
Ubuntu:16.04:LTS
 before 16.0.0-1ubuntu0.4, plus listed versions
15.2.1-1ubuntu215.5.0-115.5.0-215.5.0-2ubuntu115.5.0-4
Show 6 moreShow less
16.0.0~pre1-116.0.0~pre1-1ubuntu116.0.0~pre1-2ubuntu116.0.0~pre1-316.0.0-116.0.0-1ubuntu0.2
16.0.0-1ubuntu0.4
go1.12
openSUSE:Leap 15.1
 before 1.12.9-lp151.2.9.1
1.12.9-lp151.2.9.1
go1.12
openSUSE:Leap 15.0
 before 1.12.9-lp151.2.13.1
1.12.9-lp151.2.13.1
go1.12
openSUSE:Leap 15.1
 before 1.12.9-lp151.2.13.1
1.12.9-lp151.2.13.1
go1.11
openSUSE:Leap 15.0
 before 1.11.13-lp151.2.9.1
1.11.13-lp151.2.9.1
go1.11
openSUSE:Leap 15.1
 before 1.11.13-lp151.2.9.1
1.11.13-lp151.2.9.1
go1.12
openSUSE:Leap 15.1
 before 1.12.9-lp151.2.17.1
1.12.9-lp151.2.17.1
nodejs10
openSUSE:Leap 15.0
 before 10.16.3-lp151.2.6.1
10.16.3-lp151.2.6.1
nodejs10
openSUSE:Leap 15.1
 before 10.16.3-lp151.2.6.1
10.16.3-lp151.2.6.1
nodejs8
openSUSE:Leap 15.0
 before 8.16.1-lp151.2.6.1
8.16.1-lp151.2.6.1
nodejs8
openSUSE:Leap 15.1
 before 8.16.1-lp151.2.6.1
8.16.1-lp151.2.6.1
go1.12
openSUSE:Leap 15.1
 before 1.12.9-lp151.2.21.1
1.12.9-lp151.2.21.1
go1.11
openSUSE:Tumbleweed
 before 1.11.13-10.5
1.11.13-10.5
go1.12
openSUSE:Tumbleweed
 before 1.12.17-4.8
1.12.17-4.8
notary
openSUSE:Tumbleweed
 before 0.7.0-1.2
0.7.0-1.2
python-Twisted
openSUSE:Tumbleweed
 before 21.7.0-3.2
21.7.0-3.2

History

History
RecordedChangedSources
affectedOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-9512 is a high vulnerability (CVSS 7.5) in Apache Traffic Server, published August 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 83.4%, the 99th percentile. Fixed in golang.org/x/net 0.0.0-20190813141303-74dc4d7220e7.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 503 package rows and 464 references. The JSON record has them. Left out on purpose, here and in the API, to keep responses small: 20 source records.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open