{"id":"CVE-2019-9518","aliases":["ALPINE-CVE-2019-9518","ALSA-2019:2925","BELL-CVE-2019-9518","DEBIAN-CVE-2019-9518","DSA-4520-1","EUVD-2019-18890","GHSA-93p3-5r25-4p75","MGASA-2020-0372","RHSA-2019:2925","RHSA-2019:2939","RHSA-2019:2955","RLSA-2019:2925","SUSE-SU-2019:14246-1","SUSE-SU-2019:2254-1","SUSE-SU-2019:2259-1","SUSE-SU-2019:2260-1","SUSE-SU-2020:0059-1","UBUNTU-CVE-2019-9518","USN-4866-1","openSUSE-SU-2019:2114-1","openSUSE-SU-2019:2115-1"],"status":"published","title":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.25448,"percentile":0.97962,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2019-08-13T00:00:00Z","modified":"2026-10-29T11:12:10Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"nodejs","fixed_in":["10.16.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"trafficserver","fixed_in":["8.0.5+ds-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","fixed_in":["1:4.1.7-4ubuntu0.1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2023+d2377ea3"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.3-1.module_el8.3.0+2047+b07ac28e"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2224+b07ac28e"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.4.0+2521+c668cc9f"}]}],"bundled":9},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17-3.module_el8.3.0+2023+d2377ea3"}]}],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.5+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2+ds-1+deb10u1"}]}],"versions":["8.0.2+ds-1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:7","package":"libuv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.34.2-1.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Mageia:7","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.22.1-9.mga7"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.16.3-2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.16.3-2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.16.3-2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.16.3-2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.16.3-2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:10.16.3-2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8+2632+6c5111ed"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8+2873+aa7dfd9a"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.9.0-1.10.16.3.2.module+el8.0.0+4214+49953fda"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.16.3-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.16.3-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.16.3-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.16.3-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.9.0-10.16.3.3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs10-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2-3.el7"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-5.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.16.1-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.16.1-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.16.1-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-nodejs-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.16.1-2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.1-8.16.1.2.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-runtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-5.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-nodejs8-scldevel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0-5.el7"}]}],"bundled":8},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-nodemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.18.3-1.module+el8.3.0+101+f84c7154"}]}],"bundled":9},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nodejs-packaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:17-3.module+el8.3.0+101+f84c7154"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68.2.0-78.51.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"68-21.9.8"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-atk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.26.1-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-cairo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.10-2.13.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gdk-pixbuf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.36.11-2.8.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-glib2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.54.3-2.14.7"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.9-2.15.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-harfbuzz","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1.git259-2.3.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-14.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"firefox-pango","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.14-2.7.4"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nspr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.21-29.6.1"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.45-38.9.3"}]}],"bundled":118},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-1.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-1.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-1.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-3.20.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 15 SP1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-3.20.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"nodejs12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.13.0-1.3.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.7-4ubuntu0.1+esm1"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"trafficserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-5","7.1.2+ds-2","7.1.2+ds-2build1","7.1.2+ds-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"netty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.7-4ubuntu0.1+esm1"}]}],"versions":["1:4.1.7-4","1:4.1.7-4ubuntu0.1~esm1","1:4.1.7-4ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-lp151.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.16.3-lp151.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-lp151.2.6.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"nodejs8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-lp151.2.6.1"}]}],"bundled":8}],"products":[{"vendor":"apache","product":"traffic_server"},{"vendor":"apple","product":"swiftnio"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mcafee","product":"web_gateway"},{"vendor":"nodejs","product":"node.js"},{"vendor":"opensuse","product":"leap"},{"vendor":"oracle","product":"graalvm"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"jboss_core_services"},{"vendor":"redhat","product":"jboss_enterprise_application_platform"},{"vendor":"redhat","product":"openshift_service_mesh"},{"vendor":"redhat","product":"quay"},{"vendor":"redhat","product":"software_collections"},{"vendor":"synology","product":"diskstation_manager"},{"vendor":"synology","product":"skynas"},{"vendor":"synology","product":"vs960hd_firmware"}],"references":[{"url":"https://kb.cert.org/vuls/id/605641/","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource","advisory","article"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","article","report"]},{"url":"https://seclists.org/bugtraq/2019/Aug/24","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2019/Aug/16","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.synology.com/security/advisory/Synology_SA_19_33","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K46011592","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d%40%3Cannounce.trafficserver.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61%40%3Cusers.trafficserver.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107%40%3Cdev.trafficserver.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190823-0005/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.debian.org/security/2019/dsa-4520","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Sep/18","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10296","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2925","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2939","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2955","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.f5.com/csp/article/K46011592?utm_source=f5support\u0026amp%3Butm_medium=RSS","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3892","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4352","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0727","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75%40%3Ccommits.cassandra.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9518","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/091b518265bce56a16af87b77c8cfacda902a02079e866f9fdf13b61@%3Cusers.trafficserver.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/2653c56545573b528f3f6352a29eccaf498bd6fb2a6a59568d81a61d@%3Cannounce.trafficserver.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/ff5b0821a6985159a832ff6d1a4bd311ac07ecc7db1e2d8bab619107@%3Cdev.trafficserver.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/r99a625fb17032646d96cd23dec49603ff630e9318e44a686d63046bc@%3Ccommits.cassandra.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rd31230d01fa6aad18bdadc0720acd1747e53690bd35f73a48e7a9b75@%3Ccommits.cassandra.apache.org%3E"},{"url":"https://support.f5.com/csp/article/K46011592?utm_source=f5support\u0026amp;utm_medium=RSS"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP"},{"url":"https://security.netapp.com/advisory/ntap-20190823-0005"},{"url":"https://kb.cert.org/vuls/id/605641"},{"url":"https://github.com/advisories/GHSA-93p3-5r25-4p75"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-9518","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2019-2925.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-5737","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9511","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9512","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9513","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9514","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9515","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9516","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9517","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9518","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-9518","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9518","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0372.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25314","tags":["report"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2019-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2020-security-releases/","tags":["web"]},{"url":"https://nodejs.org/en/blog/vulnerability/september-2020-security-releases/","tags":["web"]},{"url":"https://github.com/nodejs/node/blob/v10.x/doc/changelogs/CHANGELOG_V10.md","tags":["web"]},{"url":"https://github.com/nghttp2/nghttp2/releases/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735749","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741868","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2925.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-5737","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690808","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-5737","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-5737","tags":["advisory"]},{"url":"https://nodejs.org/ja/blog/vulnerability/february-2019-security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9511","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9511","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9511","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/","tags":["article"]},{"url":"https://www.nginx.com/blog/nginx-updates-mitigate-august-2019-http-2-vulnerabilities/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9512","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA","tags":["article"]},{"url":"https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9513","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9513","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9513","tags":["advisory"]},{"url":"https://nghttp2.org/blog/2019/08/19/nghttp2-v1-39-2/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9514","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9514","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9515","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9515","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9516","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9516","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9516","tags":["advisory"]},{"url":"https://github.com/nghttp2/nghttp2/issues/1382#","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9517","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9517","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9517","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9518","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9518","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2939.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1661002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12121","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12121","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1661005","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12122","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-12123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1661010","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-12123","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-12123","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2955.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:2925","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1000036","tags":["report"]},{"url":"https://bugzilla.suse.com/1001652","tags":["report"]},{"url":"https://bugzilla.suse.com/1025108","tags":["report"]},{"url":"https://bugzilla.suse.com/1029377","tags":["report"]},{"url":"https://bugzilla.suse.com/1029902","tags":["report"]},{"url":"https://bugzilla.suse.com/1040164","tags":["report"]},{"url":"https://bugzilla.suse.com/104105","tags":["report"]},{"url":"https://bugzilla.suse.com/1042670","tags":["report"]},{"url":"https://bugzilla.suse.com/1043008","tags":["report"]},{"url":"https://bugzilla.suse.com/1044946","tags":["report"]},{"url":"https://bugzilla.suse.com/1047925","tags":["report"]},{"url":"https://bugzilla.suse.com/1047936","tags":["report"]},{"url":"https://bugzilla.suse.com/1048299","tags":["report"]},{"url":"https://bugzilla.suse.com/1049186","tags":["report"]},{"url":"https://bugzilla.suse.com/1050653","tags":["report"]},{"url":"https://bugzilla.suse.com/1056058","tags":["report"]},{"url":"https://bugzilla.suse.com/1058013","tags":["report"]},{"url":"https://bugzilla.suse.com/1066242","tags":["report"]},{"url":"https://bugzilla.suse.com/1066953","tags":["report"]},{"url":"https://bugzilla.suse.com/1070738","tags":["report"]},{"url":"https://bugzilla.suse.com/1070853","tags":["report"]},{"url":"https://bugzilla.suse.com/1072320","tags":["report"]},{"url":"https://bugzilla.suse.com/1072322","tags":["report"]},{"url":"https://bugzilla.suse.com/1073796","tags":["report"]},{"url":"https://bugzilla.suse.com/1073798","tags":["report"]},{"url":"https://bugzilla.suse.com/1073799","tags":["report"]},{"url":"https://bugzilla.suse.com/1073803","tags":["report"]},{"url":"https://bugzilla.suse.com/1073808","tags":["report"]},{"url":"https://bugzilla.suse.com/1073818","tags":["report"]},{"url":"https://bugzilla.suse.com/1073823","tags":["report"]},{"url":"https://bugzilla.suse.com/1073829","tags":["report"]},{"url":"https://bugzilla.suse.com/1073830","tags":["report"]},{"url":"https://bugzilla.suse.com/1073832","tags":["report"]},{"url":"https://bugzilla.suse.com/1073846","tags":["report"]},{"url":"https://bugzilla.suse.com/1074235","tags":["report"]},{"url":"https://bugzilla.suse.com/1077230","tags":["report"]},{"url":"https://bugzilla.suse.com/1079761","tags":["report"]},{"url":"https://bugzilla.suse.com/1081750","tags":["report"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1087453","tags":["report"]},{"url":"https://bugzilla.suse.com/1087459","tags":["report"]},{"url":"https://bugzilla.suse.com/1087463","tags":["report"]},{"url":"https://bugzilla.suse.com/1088573","tags":["report"]},{"url":"https://bugzilla.suse.com/1091764","tags":["report"]},{"url":"https://bugzilla.suse.com/1094814","tags":["report"]},{"url":"https://bugzilla.suse.com/1097158","tags":["report"]},{"url":"https://bugzilla.suse.com/1097375","tags":["report"]},{"url":"https://bugzilla.suse.com/1097401","tags":["report"]},{"url":"https://bugzilla.suse.com/1097404","tags":["report"]},{"url":"https://bugzilla.suse.com/1097748","tags":["report"]},{"url":"https://bugzilla.suse.com/1104841","tags":["report"]},{"url":"https://bugzilla.suse.com/1105019","tags":["report"]},{"url":"https://bugzilla.suse.com/1107030","tags":["report"]},{"url":"https://bugzilla.suse.com/1109465","tags":["report"]},{"url":"https://bugzilla.suse.com/1117473","tags":["report"]},{"url":"https://bugzilla.suse.com/1117626","tags":["report"]},{"url":"https://bugzilla.suse.com/1117627","tags":["report"]},{"url":"https://bugzilla.suse.com/1117629","tags":["report"]},{"url":"https://bugzilla.suse.com/1117630","tags":["report"]},{"url":"https://bugzilla.suse.com/1120644","tags":["report"]},{"url":"https://bugzilla.suse.com/1122191","tags":["report"]},{"url":"https://bugzilla.suse.com/1123482","tags":["report"]},{"url":"https://bugzilla.suse.com/1124525","tags":["report"]},{"url":"https://bugzilla.suse.com/1127532","tags":["report"]},{"url":"https://bugzilla.suse.com/1129346","tags":["report"]},{"url":"https://bugzilla.suse.com/1130694","tags":["report"]},{"url":"https://bugzilla.suse.com/1130840","tags":["report"]},{"url":"https://bugzilla.suse.com/1133452","tags":["report"]},{"url":"https://bugzilla.suse.com/1133810","tags":["report"]},{"url":"https://bugzilla.suse.com/1134209","tags":["report"]},{"url":"https://bugzilla.suse.com/1138459","tags":["report"]},{"url":"https://bugzilla.suse.com/1140290","tags":["report"]},{"url":"https://bugzilla.suse.com/1140868","tags":["report"]},{"url":"https://bugzilla.suse.com/1141853","tags":["report"]},{"url":"https://bugzilla.suse.com/1144919","tags":["report"]},{"url":"https://bugzilla.suse.com/1145665","tags":["report"]},{"url":"https://bugzilla.suse.com/1146090","tags":["report"]},{"url":"https://bugzilla.suse.com/1146091","tags":["report"]},{"url":"https://bugzilla.suse.com/1146093","tags":["report"]},{"url":"https://bugzilla.suse.com/1146094","tags":["report"]},{"url":"https://bugzilla.suse.com/1146095","tags":["report"]},{"url":"https://bugzilla.suse.com/1146097","tags":["report"]},{"url":"https://bugzilla.suse.com/1146099","tags":["report"]},{"url":"https://bugzilla.suse.com/1146100","tags":["report"]},{"url":"https://bugzilla.suse.com/1149323","tags":["report"]},{"url":"https://bugzilla.suse.com/1153423","tags":["report"]},{"url":"https://bugzilla.suse.com/1154738","tags":["report"]},{"url":"https://bugzilla.suse.com/1447070","tags":["report"]},{"url":"https://bugzilla.suse.com/1447409","tags":["report"]},{"url":"https://bugzilla.suse.com/744625","tags":["report"]},{"url":"https://bugzilla.suse.com/744629","tags":["report"]},{"url":"https://bugzilla.suse.com/845955","tags":["report"]},{"url":"https://bugzilla.suse.com/865853","tags":["report"]},{"url":"https://bugzilla.suse.com/905528","tags":["report"]},{"url":"https://bugzilla.suse.com/917607","tags":["report"]},{"url":"https://bugzilla.suse.com/935856","tags":["report"]},{"url":"https://bugzilla.suse.com/937414","tags":["report"]},{"url":"https://bugzilla.suse.com/947747","tags":["report"]},{"url":"https://bugzilla.suse.com/948045","tags":["report"]},{"url":"https://bugzilla.suse.com/948602","tags":["report"]},{"url":"https://bugzilla.suse.com/955142","tags":["report"]},{"url":"https://bugzilla.suse.com/957814","tags":["report"]},{"url":"https://bugzilla.suse.com/957815","tags":["report"]},{"url":"https://bugzilla.suse.com/961254","tags":["report"]},{"url":"https://bugzilla.suse.com/962297","tags":["report"]},{"url":"https://bugzilla.suse.com/966076","tags":["report"]},{"url":"https://bugzilla.suse.com/966077","tags":["report"]},{"url":"https://bugzilla.suse.com/985201","tags":["report"]},{"url":"https://bugzilla.suse.com/986541","tags":["report"]},{"url":"https://bugzilla.suse.com/991344","tags":["report"]},{"url":"https://bugzilla.suse.com/998743","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5325","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11111","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-18207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-3738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12121","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12122","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7158","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11716","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11735","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11762","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192254-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192259-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192260-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200059-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149792","tags":["report"]},{"url":"https://bugzilla.suse.com/SLE-8947","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9518","tags":["report"]},{"url":"https://netty.io/news/2019/08/13/4-1-39-Final.html","tags":["report"]},{"url":"https://github.com/netty/netty/pull/9461","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4866-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9512","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9514","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-9515","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R3H4KAW53AW5JRYOIFARBV2NZCYA2XCC/#R3H4KAW53AW5JRYOIFARBV2NZCYA2XCC","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TLFKC75QWUPCRCPS6I4CH5LO7W5G2JQK/#TLFKC75QWUPCRCPS6I4CH5LO7W5G2JQK","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9518","title":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T20:50:59Z","modified":"2024-08-04T21:54:44.51Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-18890","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T20:50:59Z","modified":"2024-08-04T21:54:44Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:06:38.242317Z"}],"ghsa":[{"id":"GHSA-93p3-5r25-4p75","title":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a...","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2022-05-24T16:53:20Z","modified":"2025-01-14T21:32:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:59:31.794566Z"}],"nvd":[{"id":"CVE-2019-9518","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T21:15:13.003Z","modified":"2026-06-17T02:43:53.733Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:05:22.878504Z"}],"osv":[{"id":"ALPINE-CVE-2019-9518","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T21:15:13.003Z","modified":"2026-09-21T06:17:52.559346809Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2019-9518","title":"CVE-2019-9518 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:33.684686Z","modified":"2026-02-18T07:38:21.8827Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-9518","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T21:15:13.003Z","modified":"2026-10-24T10:30:48.749769908Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"DEBIAN-CVE-2019-9518","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T21:15:13.003Z","modified":"2026-09-21T07:02:57.013672251Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2019:2925","title":"Red Hat Security Advisory: nodejs:10 security update","status":"published","published":"2024-10-09T06:53:03Z","modified":"2026-10-13T10:01:22Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2939","title":"Red Hat Security Advisory: rh-nodejs10-nodejs security update","status":"published","published":"2024-09-20T13:54:24Z","modified":"2026-10-13T10:01:23Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2955","title":"Red Hat Security Advisory: rh-nodejs8-nodejs security update","status":"published","published":"2024-09-20T13:54:36Z","modified":"2026-10-13T10:01:25Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RLSA-2019:2925","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.16.3).\n\nSecurity Fix(es):\n\n* HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)\n\n* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)\n\n* HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)\n\n* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)\n\n* HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)\n\n* HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)\n\n* HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\n* HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-09-30T07:07:29Z","modified":"2026-02-04T21:45:07.789295Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-9518","description":"Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The attacker sends a stream of frames with an empty payload and without the end-of-stream flag. These frames can be DATA, HEADERS, CONTINUATION and/or PUSH_PROMISE. The peer spends time processing each frame disproportionate to attack bandwidth. This can consume excess CPU.","status":"published","published":"2019-08-13T00:00:00Z","modified":"2026-04-22T12:24:13.083027Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"ALSA-2019:2925","title":"Important: nodejs:10 security update","description":"Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.\n\nThe following packages have been upgraded to a later upstream version: nodejs (10.16.3).\n\nSecurity Fix(es):\n\n* HTTP/2: large amount of data requests leads to denial of service (CVE-2019-9511)\n\n* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)\n\n* HTTP/2: flood using PRIORITY frames results in excessive resource consumption (CVE-2019-9513)\n\n* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)\n\n* HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)\n\n* HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)\n\n* HTTP/2: request for large response leads to denial of service (CVE-2019-9517)\n\n* HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2019-09-30T07:07:29Z","modified":"2026-10-29T11:12:10.68029884Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DSA-4520-1","title":"trafficserver - security update","status":"published","published":"2019-09-09T00:00:00Z","modified":"2026-03-09T02:11:19.261996Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2020-0372","title":"Updated nodejs packages fix security vulnerabilities","description":"The nodejs package has been updated to the latest version in the 10.x branch,\nwhich is 10.22.1 at this time.  It fixes several security issues and other\nbugs.  See the upstream changelog and advisories for details.\n","status":"published","published":"2020-09-27T20:06:37Z","modified":"2026-04-16T04:43:16.918624291Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2019:2114-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.16.3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).\n- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-10T16:22:24Z","modified":"2026-02-04T02:57:34.696137Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2115-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.16.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).\n- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n\nBug fixes:\n\n- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-10T16:22:52Z","modified":"2026-02-04T02:49:38.771497Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"SUSE-SU-2019:14246-1","title":"Security update for Mozilla Firefox","description":"\nThis update contains the Mozilla Firefox ESR 68.2 release.\n\nMozilla Firefox was updated to ESR 68.2 release:\n\n* Enterprise: New administrative policies were added. More\n  information and templates are available at the Policy\n  Templates page.\n\n* Various security fixes:\n  MFSA 2019-33 (bsc#1154738)\n  * CVE-2019-15903: Heap overflow in expat library in XML_GetCurrentLineNumber\n  * CVE-2019-11757: Use-after-free when creating index updates in IndexedDB\n  * CVE-2019-11758: Potentially exploitable crash due to 360 Total Security\n  * CVE-2019-11759: Stack buffer overflow in HKDF output\n  * CVE-2019-11760: Stack buffer overflow in WebRTC networking\n  * CVE-2019-11761: Unintended access to a privileged JSONView object\n  * CVE-2019-11762: document.domain-based origin isolation has same-origin- property violation\n  * CVE-2019-11763: Incorrect HTML parsing results in XSS bypass technique\n  * CVE-2019-11764: Memory safety bugs fixed in Firefox 70 and Firefox ESR 68.2\n\nOther Issues resolved:\n\n* [bsc#1104841] Newer versions of firefox have a dependency on\n                GLIBCXX_3.4.20\n* [bsc#1074235] MozillaFirefox: background tab crash reports sent\n                inadvertently without user opt-in\n* [bsc#1043008] Firefox hangs randomly when browsing and\n                scrolling\n* [bsc#1025108] Firefox stops loading page until mouse is moved\n* [bsc#905528]  Firefox malfunctions due to broken omni.ja\n                archives\n\n","status":"published","published":"2020-01-17T17:07:38Z","modified":"2026-02-04T02:31:26.178072Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2254-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.16.3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).\n- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n","status":"published","published":"2019-08-29T16:53:45Z","modified":"2026-02-04T02:31:13.788109Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2259-1","title":"Security update for nodejs10","description":"This update for nodejs10 to version 10.16.3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).\n- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n","status":"published","published":"2019-09-02T07:04:04Z","modified":"2026-02-04T04:22:50.088229Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2260-1","title":"Security update for nodejs8","description":"This update for nodejs8 to version 8.16.1 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146091).\n- CVE-2019-9512: Fixed HTTP/2 flood using PING frames results in unbounded memory growth (bsc#1146099).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service. (bsc#1146094).\n- CVE-2019-9514: Fixed HTTP/2 implementation that is vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed HTTP/2 flood using SETTINGS frames results in unbounded memory growth (bsc#1146100).\n- CVE-2019-9516: Fixed HTTP/2 implementation that is vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed HTTP/2 implementations that are vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed HTTP/2 implementation that is vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n\nBug fixes:\n\n- Fixed that npm resolves its default config file like in all other versions, as /etc/nodejs/npmrc (bsc#1144919).\n","status":"published","published":"2019-09-02T07:04:20Z","modified":"2026-02-04T03:31:30.783717Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2020:0059-1","title":"Security update for nodejs12","description":"This update for nodejs12 fixes the following issues:\n\nUpdate to LTS release 12.13.0 (jsc#SLE-8947).\n\nSecurity issues fixed:\n\n- CVE-2019-9511: Fixed the HTTP/2 implementation that was vulnerable to window size manipulations (bsc#1146091).\n- CVE-2019-9512: Fixed the HTTP/2 implementation that was vulnerable to floods using PING frames (bsc#1146099).\n- CVE-2019-9513: Fixed the HTTP/2 implementation that was vulnerable to resource loops, potentially leading to a denial of service (bsc#1146094).\n- CVE-2019-9514: Fixed the HTTP/2 implementation that was vulnerable to a reset flood, potentially leading to a denial of service (bsc#1146095).\n- CVE-2019-9515: Fixed the HTTP/2 implementation that was vulnerable to a SETTINGS frame flood (bsc#1146100).\n- CVE-2019-9516: Fixed the HTTP/2 implementation that was vulnerable to a header leak, potentially leading to a denial of service (bsc#1146090).\n- CVE-2019-9517: Fixed the HTTP/2 implementation that was vulnerable to unconstrained interal data buffering (bsc#1146097).\n- CVE-2019-9518: Fixed the HTTP/2 implementation that was vulnerable to a flood of empty frames, potentially leading to a denial of service (bsc#1146093).\n- CVE-2019-13173: Fixed a file overwrite in the fstream.DirWriter() function (bsc#1140290).\n","status":"published","published":"2020-01-09T12:30:16Z","modified":"2026-02-04T03:18:59.602282Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"USN-4866-1","title":"netty vulnerabilities","description":"It was discovered that Netty incorrectly implements HTTP/2. An attacker\ncould possibly use this issue to cause a denial of service. (CVE-2019-9512,\nCVE-2019-9514, CVE-2019-9515, CVE-2019-9518)","status":"published","published":"2021-06-29T19:18:08Z","modified":"2026-04-27T15:50:07.46514Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}