Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-dmv4-ydq9-a7eq
Vulnerability ID VCID-dmv4-ydq9-a7eq
Aliases CVE-2019-9511
Summary Excessive CPU usage in HTTP/2 with small window updates
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-400 Uncontrolled Resource Consumption
System Score Found at
cvssv3 6.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9511.json
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
epss 0.13948 https://api.first.org/data/v1/epss?cve=CVE-2019-9511
cvssv3 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual medium https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html
archlinux Medium https://security.archlinux.org/AVG-1022
archlinux Medium https://security.archlinux.org/AVG-1023
archlinux Medium https://security.archlinux.org/AVG-1024
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9511.json
https://api.first.org/data/v1/epss?cve=CVE-2019-9511
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15604
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15605
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15606
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9511
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9513
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9516
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://mailman.nginx.org/pipermail/nginx-announce/2019/000249.html
1741860 https://bugzilla.redhat.com/show_bug.cgi?id=1741860
934885 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934885
935037 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=935037
ASA-201908-12 https://security.archlinux.org/ASA-201908-12
ASA-201908-13 https://security.archlinux.org/ASA-201908-13
ASA-201908-17 https://security.archlinux.org/ASA-201908-17
AVG-1022 https://security.archlinux.org/AVG-1022
AVG-1023 https://security.archlinux.org/AVG-1023
AVG-1024 https://security.archlinux.org/AVG-1024
CVE-2019-9511 https://nvd.nist.gov/vuln/detail/CVE-2019-9511
RHSA-2019:2692 https://access.redhat.com/errata/RHSA-2019:2692
RHSA-2019:2745 https://access.redhat.com/errata/RHSA-2019:2745
RHSA-2019:2746 https://access.redhat.com/errata/RHSA-2019:2746
RHSA-2019:2775 https://access.redhat.com/errata/RHSA-2019:2775
RHSA-2019:2799 https://access.redhat.com/errata/RHSA-2019:2799
RHSA-2019:2946 https://access.redhat.com/errata/RHSA-2019:2946
RHSA-2019:2949 https://access.redhat.com/errata/RHSA-2019:2949
RHSA-2019:3041 https://access.redhat.com/errata/RHSA-2019:3041
RHSA-2019:3932 https://access.redhat.com/errata/RHSA-2019:3932
RHSA-2019:3933 https://access.redhat.com/errata/RHSA-2019:3933
RHSA-2019:3935 https://access.redhat.com/errata/RHSA-2019:3935
RHSA-2020:0922 https://access.redhat.com/errata/RHSA-2020:0922
RHSA-2020:1445 https://access.redhat.com/errata/RHSA-2020:1445
RHSA-2020:2067 https://access.redhat.com/errata/RHSA-2020:2067
RHSA-2020:2565 https://access.redhat.com/errata/RHSA-2020:2565
RHSA-2020:3192 https://access.redhat.com/errata/RHSA-2020:3192
RHSA-2024:5856 https://access.redhat.com/errata/RHSA-2024:5856
USN-4099-1 https://usn.ubuntu.com/4099-1/
USN-6754-1 https://usn.ubuntu.com/6754-1/
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-9511.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.94283
EPSS Score 0.13948
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:31:46.130328+00:00 Nginx Importer Import https://nginx.org/en/security_advisories.html 38.0.0