Home > Vulnerability Database > CVE-2019-10081

Mend.io Vulnerability Database

CVE-2019-10081

Date: August 15, 2019

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.

Severity Score

7.5

Related Resources (27)

Url: https://support.f5.com/csp/article/K84341091?utm_source=f5support&utm_medium=RSS

Url: https://lists.apache.org/thread.html/r06f0d87ebb6d59ed8379633f36f72f5b1f79cadfda72ede0830b42cf@%3Ccvs.httpd.apache.org%3E

Url: https://www.oracle.com/security-alerts/cpuapr2020.html

Url: https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html

Url: https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E

Url: https://httpd.apache.org/security/vulnerabilities_24.html

Url: https://security-tracker.debian.org/tracker/CVE-2019-10081

Url: https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E

Url: https://nvd.nist.gov/vuln/detail/CVE-2019-10081

Url: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00004.html

Url: https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E

Url: https://access.redhat.com/security/cve/CVE-2019-10081

Url: https://www.oracle.com/security-alerts/cpujul2020.html

Url: https://www.debian.org/security/2019/dsa-4509

Url: https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/r3c5c3104813c1c5508b55564b66546933079250a46ce50eee90b2e36@%3Ccvs.httpd.apache.org%3E

Url: https://seclists.org/bugtraq/2019/Aug/47

Url: https://lists.apache.org/thread.html/r03ee478b3dda3e381fd6189366fa7af97c980d2f602846eef935277d@%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E

Url: https://lists.apache.org/thread.html/rd2fb621142e7fa187cfe12d7137bf66e7234abcbbcd800074c84a538@%3Ccvs.httpd.apache.org%3E

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2019-10081

Url: https://security.gentoo.org/glsa/201909-04

Url: https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E

Url: https://security.alpinelinux.org/vuln/CVE-2019-10081

Url: https://usn.ubuntu.com/4113-1/

Url: https://security.netapp.com/advisory/ntap-20190905-0003/

Url: https://www.mend.io/vulnerability-database/CVE-2019-10081

Severity Score

7.5

Weakness Type (CWE)

Out-of-bounds Write

CWE-787

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2019-10081

Date: August 15, 2019

Severity Score

Related Resources (27)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?