# CVE-2019-9514: golang.org/x/net/http vulnerable to a reset flood > CVE-2019-9514 (GitHub advisory GHSA-39qc-96h7-956f) is a high-severity vulnerability with a CVSS 3.1 base score of 7.5, classed as Uncontrolled Resource Consumption (CWE-400), in golang.org/x/net (Go). Affected versions: < 0.0.0-20190813141303-74dc4d7220e7. It is fixed in 0.0.0-20190813141303-74dc4d7220e7. Canonical page: https://cveminer.com/vulnerabilities/CVE-2019-9514 | Field | Value | | --- | --- | | CVE | CVE-2019-9514 | | GHSA | GHSA-39qc-96h7-956f | | Other GHSAs | GHSA-hgr8-6h9x-f7q9 | | Severity | High | | CVSS 3.1 | 7.5 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (GitHub Advisory Database) | | CVSS 3.0 | 7.5 `CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (CVE.org) | | CWE | CWE-400 Uncontrolled Resource Consumption; CWE-770 Allocation of Resources Without Limits or Throttling | | EPSS | 82.81% (higher than 99.6% of CVEs) | | CISA KEV | Not listed | | Published | 13 Aug 2019 | | Modified | 4 Aug 2024 | ## Description Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ##### Specific Go Packages Affected golang.org/x/net/http2 ## Affected packages | Package | Ecosystem | PURL | Vulnerable versions | Fixed in | | --- | --- | --- | --- | --- | | golang.org/x/net | Go | `pkg:golang/golang.org/x/net` | < 0.0.0-20190813141303-74dc4d7220e7 | 0.0.0-20190813141303-74dc4d7220e7 | ## Questions **What is the GHSA ID for CVE-2019-9514?** GitHub tracks CVE-2019-9514 as GHSA-39qc-96h7-956f. It is also covered by GHSA-hgr8-6h9x-f7q9. **What is the CVSS score of CVE-2019-9514?** CVE-2019-9514 has a CVSS 3.1 base score of 7.5 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Other published scores: CVSS 3.0 7.5. **Which versions are affected by CVE-2019-9514?** golang.org/x/net (Go): < 0.0.0-20190813141303-74dc4d7220e7. **How do I fix CVE-2019-9514?** Upgrade to 0.0.0-20190813141303-74dc4d7220e7 or later. **What is the Package URL (PURL) for CVE-2019-9514?** The affected package's PURL is pkg:golang/golang.org/x/net. **Is CVE-2019-9514 exploited in the wild?** CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2019-9514. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. EPSS estimates a 82.81% chance of exploitation in the next 30 days, higher than 99.6% of CVEs. ## References - https://nvd.nist.gov/vuln/detail/CVE-2019-9514 (advisory) - https://access.redhat.com/errata/RHSA-2019:2594 (advisory) - https://kb.cert.org/vuls/id/605641 (advisory) - https://kc.mcafee.com/corporate/index?page=content&id=SB10296 (advisory) - https://lists.debian.org/debian-lts-announce/2020/12/msg00011.html (advisory) - https://seclists.org/bugtraq/2019/Aug/24 (advisory) - https://seclists.org/bugtraq/2019/Aug/31 (advisory) - https://seclists.org/bugtraq/2019/Aug/43 (advisory) - https://seclists.org/bugtraq/2019/Sep/18 (advisory) - https://security.netapp.com/advisory/ntap-20190823-0001 (advisory) - https://security.netapp.com/advisory/ntap-20190823-0004 (advisory) - https://security.netapp.com/advisory/ntap-20190823-0005 (advisory) - https://support.f5.com/csp/article/K01988340 (advisory) - https://usn.ubuntu.com/4308-1 (advisory) - https://www.debian.org/security/2019/dsa-4503 (advisory) - https://www.debian.org/security/2019/dsa-4508 (advisory) - https://www.debian.org/security/2019/dsa-4520 (advisory) - https://www.debian.org/security/2020/dsa-4669 (advisory) - https://www.synology.com/security/advisory/Synology_SA_19_33 (advisory) - https://access.redhat.com/errata/RHSA-2019:2661 (advisory) - https://access.redhat.com/errata/RHSA-2019:2682 (advisory) - https://access.redhat.com/errata/RHSA-2019:2690 (advisory) - https://access.redhat.com/errata/RHSA-2019:2726 (advisory) - https://access.redhat.com/errata/RHSA-2019:2766 (advisory) - https://access.redhat.com/errata/RHSA-2019:2769 (advisory) - https://access.redhat.com/errata/RHSA-2019:2796 (advisory) - https://access.redhat.com/errata/RHSA-2019:2861 (advisory) - https://access.redhat.com/errata/RHSA-2019:2925 (advisory) - https://access.redhat.com/errata/RHSA-2019:2939 (advisory) - https://access.redhat.com/errata/RHSA-2019:2955 (advisory) - https://access.redhat.com/errata/RHSA-2019:2966 (advisory) - https://access.redhat.com/errata/RHSA-2019:3131 (advisory) - https://access.redhat.com/errata/RHSA-2019:3245 (advisory) - https://access.redhat.com/errata/RHSA-2019:3265 (advisory) - https://access.redhat.com/errata/RHSA-2019:3892 (advisory) - https://access.redhat.com/errata/RHSA-2019:3906 (advisory) - https://access.redhat.com/errata/RHSA-2019:4018 (advisory) - https://access.redhat.com/errata/RHSA-2019:4019 (advisory) - https://access.redhat.com/errata/RHSA-2019:4020 (advisory) - https://access.redhat.com/errata/RHSA-2019:4021 (advisory) - https://access.redhat.com/errata/RHSA-2019:4040 (advisory) - https://access.redhat.com/errata/RHSA-2019:4041 (advisory) - https://access.redhat.com/errata/RHSA-2019:4042 (advisory) - https://access.redhat.com/errata/RHSA-2019:4045 (advisory) - https://access.redhat.com/errata/RHSA-2019:4269 (advisory) - https://access.redhat.com/errata/RHSA-2019:4273 (advisory) - https://access.redhat.com/errata/RHSA-2019:4352 (advisory) - https://access.redhat.com/errata/RHSA-2020:0406 (advisory) - https://access.redhat.com/errata/RHSA-2020:0727 (advisory) - https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00076.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00002.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00011.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00021.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html (advisory) - http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00038.html (advisory) - http://seclists.org/fulldisclosure/2019/Aug/16 (advisory) - http://www.openwall.com/lists/oss-security/2019/08/20/1 (advisory) - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4BBP27PZGSY6OP6D26E5FW4GZKBFHNU7/ (advisory) --- Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2019-9514), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.