CVE-2019-9511

CVE-2019-9511 describes a denial-of-service vulnerability in various HTTP/2 implementations, including those from Apache, Apple, Node.js, and Oracle. Attackers can manipulate HTTP/2 window sizes and stream priorities to force servers to queue large amounts of data in small chunks, consuming excessive CPU or memory. This vulnerability carries a CVSS score of 7.5 (High) due to its network-based attack vector, low attack complexity, and high impact on availability. While there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.