HTTP/2 Data Dribble DoS (CVE-2019-9511)

Sep 09, 2026

Attackers can cause a denial of service by manipulating HTTP/2 window sizes.

Vulnerability ID	Vulnerability Overview
CVE-2019-9511	The attacker requests a large amount of data but manipulates window size and stream priority to force the server into queueing data in tiny chunks, exhausting CPU and memory.

Affected Supported TeraStations

TS5010/3020/3010
Fixed in firmware version 6.12

Date	Description
09/09/2026	Initial release