Skip to content
CVE IDCVE-2019-9514GitHub advisory IDGHSA-39qc-96h7-956f

golang.org/x/net/http vulnerable to a reset flood

CVE-2019-9514 (GitHub advisory GHSA-39qc-96h7-956f) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Uncontrolled Resource Consumption (CWE-400), in golang.org/x/net (Go). Affected versions: < 0.0.0-20190813141303-74dc4d7220e7. It is fixed in 0.0.0-20190813141303-74dc4d7220e7.

High7.5Fix availableGitHub reviewed

Published 13 Aug 2019Updated 4 Aug 2024

CVE-2019-9514 has 2 GitHub advisories, usually one per affected project. You're viewing GHSA-39qc-96h7-956f.

7.5HighCVSS 3.1
CVE ID
CVE-2019-9514
GHSA ID
GHSA-39qc-96h7-956f
EPSS
82.81%higher than 99.6% of CVEs
Weaknesses (CWE)
  • CWE-400Uncontrolled Resource Consumption
  • CWE-770Allocation of Resources Without Limits or Throttling
KEV status
Not in KEV
Published
13 Aug 2019
Updated
4 Aug 2024
Ecosystem
  • Go
Assigned by (CNA)
certcc

Summary

Source: OSV (GitHub advisory)

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

Specific Go Packages Affected

golang.org/x/net/http2

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

High7.5Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Unchanged
Confidentiality C
None
Integrity I
None
Availability A
High

Affected packages

Source: OSV (GitHub advisory)

  • golang.org/x/net
    Go
    pkg:golang/golang.org/x/net
    Affected versions
    < 0.0.0-20190813141303-74dc4d7220e7
    Fixed in
    0.0.0-20190813141303-74dc4d7220e7

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 0.0.0-20190813141303-74dc4d7220e7 or later.

Vulnerability intelligence

References

Credits

  • Thanks to Jonathan Looney of Netflix for reporting this vulnerability.

Questions about CVE-2019-9514

What is the GHSA ID for CVE-2019-9514?
GitHub tracks CVE-2019-9514 as GHSA-39qc-96h7-956f. It is also covered by GHSA-hgr8-6h9x-f7q9.
What is the CVSS score of CVE-2019-9514?
CVE-2019-9514 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Other published scores: CVSS 3.0 7.5.
Which versions are affected by CVE-2019-9514?
golang.org/x/net (Go): < 0.0.0-20190813141303-74dc4d7220e7.
How do I fix CVE-2019-9514?
Upgrade to 0.0.0-20190813141303-74dc4d7220e7 or later.
What is the Package URL (PURL) for CVE-2019-9514?
The affected package's PURL is pkg:golang/golang.org/x/net.
Is CVE-2019-9514 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2019-9514. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 82.81% chance of exploitation in the next 30 days, higher than 99.6% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 2 days ago (13 Oct 2026, 12:49 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.