CVE detail

CVE-2019-9511 — CVE-2019-9511

Published 2019-08-13 · Modified 2026-06-17 · Vendor apple · Product swiftnio · Source nvd

HIGH

severity

CVSS-derived band

7.5

CVSS v3

0–10 scale

0.5955

EPSS probability

exploitation probability, 30d

99.0%

EPSS percentile

percentile vs all CVEs

NOT LISTED

CISA KEV

known exploited catalog

Description

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

Remediation

No vendor-published fix data in our corpus for this CVE. Check the references below or the vendor's PSIRT / security advisories page.

References

cvedb.io · NVD · CISA KEV · FIRST EPSS · vendor advisories (CVE Program List v5). Informational only, no warranty — verify every remediation against the vendor advisory before acting on it. This product uses data from the NVD API but is not endorsed or certified by the NVD, CISA, FIRST.org or any vendor named. CVE® is a registered trademark of The MITRE Corporation.