CVE-2019-9516

CVE-2019-9516 is a denial-of-service vulnerability affecting various HTTP/2 implementations, including those from Apache, Apple, Node.js, and Oracle. Attackers can exploit this by sending a continuous stream of zero-length HTTP/2 headers, causing vulnerable systems to excessively allocate and retain memory, leading to resource exhaustion. Rated Medium with a CVSS score of 6.5, this network-based attack requires low privileges and no user interaction, potentially resulting in high availability impact. While there is no evidence of active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion and media coverage, indicating awareness within the cybersecurity landscape.