HTTP/2 0-Length Headers DoS (CVE-2019-9516)

Summary

A flood of empty HTTP/2 headers can crash server processes.

Vulnerability ID	Vulnerability Overview
CVE-2019-9516	Sending a continuous stream of headers with empty names and values exhausts memory limits on the server, causing a denial of service.

Affected Supported TeraStations

TS5010/3020/3010
Fixed in firmware version 6.12
 

Back to Security Notices

Date	Description
09/09/2026	Initial release

Back to Security Notices