VulnerableCode Package Details - pkg:rpm/redhat/openshift-eventrouter@0.1-3.git5bd9251?arch=el7

Search for packages

Vulnerability	Summary	Fixed by
VCID-hbte-dsw2-y7ad Aliases: CVE-2019-9512 GHSA-hgr8-6h9x-f7q9	golang.org/x/net/http vulnerable to ping floods Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. ### Specific Go Packages Affected golang.org/x/net/http2	There are no reported fixed by versions.
VCID-n66u-b73u-zucb Aliases: CVE-2019-9514 GHSA-39qc-96h7-956f	golang.org/x/net/http vulnerable to a reset flood Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2	There are no reported fixed by versions.
VCID-zb2s-uwse-zfdf Aliases: CVE-2019-11247 GHSA-fp37-c92q-4pwq	Kubernetes kube-apiserver unauthorized access The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-hbte-dsw2-y7ad
Aliases:
CVE-2019-9512
GHSA-hgr8-6h9x-f7q9

golang.org/x/net/http vulnerable to ping floods Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. ### Specific Go Packages Affected golang.org/x/net/http2

There are no reported fixed by versions.

VCID-n66u-b73u-zucb
Aliases:
CVE-2019-9514
GHSA-39qc-96h7-956f

golang.org/x/net/http vulnerable to a reset flood Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2

There are no reported fixed by versions.

VCID-zb2s-uwse-zfdf
Aliases:
CVE-2019-11247
GHSA-fp37-c92q-4pwq

Kubernetes kube-apiserver unauthorized access The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T14:18:01.600954+00:00	RedHat Importer	Affected by	VCID-zb2s-uwse-zfdf	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-11247.json	38.0.0
2026-04-01T14:17:38.671502+00:00	RedHat Importer	Affected by	VCID-n66u-b73u-zucb	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9514.json	38.0.0
2026-04-01T14:17:27.477007+00:00	RedHat Importer	Affected by	VCID-hbte-dsw2-y7ad	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9512.json	38.0.0