New Search

HTTP/2 Server Denial of Service Vulnerability - CVE-2019-9513

oval:org.cisecurity:def:6366

A denial of service vulnerability exists in the HTTP/2 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP/2 requests. An attacker who successfully exploited the vulnerability could create a denial of service condition causing the target system to become unresponsive. To exploit this vulnerability an unauthenticated attacker could send a specially crafted HTTP packet to a target system causing the affected system to become nonresponsive. The update addresses the vulnerability by modifying how the Windows HTTP protocol stack handles HTTP/2 requests. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate user rights.

Family:
windows
Status:
ACCEPTED
Platform(s):
  • Microsoft Windows Server 2016
  • Microsoft Windows 10
  • Microsoft Windows Server 2019
Class:
vulnerability
Reference(s):
  • CVE-2019-9513
  • MSRC-CVE-2019-9513
  • KB4512497
  • KB4512517
  • KB4512507
  • KB4512516
  • KB4512501
  • KB4511553
  • KB4512508
Product(s):