CVE-2019-9512 – A Microsoft Windows HTTP/2 Ping Flood Denial of Service

In this excerpt of a Trend Micro Vulnerability Research Service vulnerability report, Saran Neti and Dusan Stevanovic of the Trend Micro Research Team detail a recent unauthenticated denial of service in Microsoft Windows Internet Information Server (IIS). The following is a portion of their write-up covering CVE-2019-9512, with a few minimal modifications.

A denial-of-service vulnerability has been recently patched in Microsoft Windows. The vulnerability is due to resource exhaustion when continually sending HTTP/2 Ping frames (not to be confused with an ICMP Ping) to the webserver. This bug was originally reported to Microsoft by Jonathan Looney of Netflix and was addressed by . It improves upon the widely used HTTP/1.1 standard by providing, among others, the following features: HTTP version negotiation for future expansion, multiplexing of multiple requests using weighted streams, and data compression of HTTP headers. HTTP/2 is a binary protocol that retains much of the use and semantics of HTTP/1.1 including its methods, status codes, and header fields. Modern browsers (e.g., Google Chrome, Mozilla Firefox, and Microsoft Edge) and web servers (e.g., Microsoft IIS, nginx, Apache httpd) include support for HTTP/2. Although HTTP/2 does not mandate a secure TLS-based transport, these implementations permit HTTP/2 only over TLS. The Application-Layer Protocol Negotiation (ALPN) TLS extension is used by endpoints in the TLS handshake to negotiate the application layer . In addition to applying the vendor-provided patch, an administrator needs to configure their server to limit the number of HTTP/2 packets accepted. This can vary based on the environment and services running on each server. The administrator must add the "HTTP/2MaxPingsPerMinute" setting in the Registry Editor. This key is found under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters. For additional information, see the vendor's advisory. Unfortunately, Microsoft offers no guidance on what values to use.

Special thanks to Saran Neti and Dusan Stevanovic of the Trend Micro Research Team for providing such a thorough analysis of this vulnerability. For an overview of Trend Micro Research services please visit for the latest in exploit techniques and security patches.