CVE ID:	CVE-2019-9516
Description:	Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-9516 Bugtraq: 20190814 APPLE-SA-2019-08-13-5 SwiftNIO HTTP/2 1.5.0 (Google Search) https://seclists.org/bugtraq/2019/Aug/24 Bugtraq: 20190822 [SECURITY] [DSA 4505-1] nginx security update (Google Search) https://seclists.org/bugtraq/2019/Aug/40 CERT/CC vulnerability note: VU#605641 https://kb.cert.org/vuls/id/605641/ Debian Security Information: DSA-4505 (Google Search) https://www.debian.org/security/2019/dsa-4505 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BP556LEG3WENHZI5TAQ6ZEBFTJB4E2IS/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CMNFX5MNYRWWIMO4BTKYQCGUDMHO3AXP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XHTKU7YQ5EEP2XNSAV4M4VJ7QCBOJMOD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4ZQGHE3WTYLYAYJEIDJVF2FIGQTAYPMC/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/POPAEC4FWL4UU4LDEGPY5NPALU24FFQD/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TAZZEVTCN2B4WT6AIBJ7XGYJMBTORJU5/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H472D5HPXN6RRXCNFML3BK5OYC52CXF2/ http://seclists.org/fulldisclosure/2019/Aug/16 https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md RedHat Security Advisories: RHSA-2019:2745 https://access.redhat.com/errata/RHSA-2019:2745 RedHat Security Advisories: RHSA-2019:2746 https://access.redhat.com/errata/RHSA-2019:2746 RedHat Security Advisories: RHSA-2019:2775 https://access.redhat.com/errata/RHSA-2019:2775 RedHat Security Advisories: RHSA-2019:2799 https://access.redhat.com/errata/RHSA-2019:2799 RedHat Security Advisories: RHSA-2019:2925 https://access.redhat.com/errata/RHSA-2019:2925 RedHat Security Advisories: RHSA-2019:2939 https://access.redhat.com/errata/RHSA-2019:2939 RedHat Security Advisories: RHSA-2019:2946 https://access.redhat.com/errata/RHSA-2019:2946 RedHat Security Advisories: RHSA-2019:2950 https://access.redhat.com/errata/RHSA-2019:2950 RedHat Security Advisories: RHSA-2019:2955 https://access.redhat.com/errata/RHSA-2019:2955 RedHat Security Advisories: RHSA-2019:2966 https://access.redhat.com/errata/RHSA-2019:2966 RedHat Security Advisories: RHSA-2019:3932 https://access.redhat.com/errata/RHSA-2019:3932 RedHat Security Advisories: RHSA-2019:3933 https://access.redhat.com/errata/RHSA-2019:3933 RedHat Security Advisories: RHSA-2019:3935 https://access.redhat.com/errata/RHSA-2019:3935 SuSE Security Announcement: openSUSE-SU-2019:2114 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00032.html SuSE Security Announcement: openSUSE-SU-2019:2115 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00031.html SuSE Security Announcement: openSUSE-SU-2019:2120 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00035.html SuSE Security Announcement: openSUSE-SU-2019:2264 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00014.html https://usn.ubuntu.com/4099-1/