HTTP2: Apache Traffic Server HTTP2 Settings Flood Denial of Service

This signature detects attempts to exploit a known vulnerability against Apache Traffic Server. A successful attack can result in a denial-of-service condition.

Extended Description

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker sends a stream of SETTINGS frames to the peer. Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Affected Products

Nodejs node.js

References

CVE: CVE-2019-9515

URL: https://raw.githubusercontent.com/apache/trafficserver/8.0.x/changelog-8.0.4 https://github.com/netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

Short Name

HTTP2:APACHE-SETTING-DNS

Severity

Major

Recommended

False

Recommended Action

None

HTTP2: Apache Traffic Server HTTP2 Settings Flood Denial of Service

Extended Description

Affected Products

References

Found a potential security threat?