{
  "schemaVersion": "1.0",
  "dataset": "ddos-cves",
  "title": "DDoS-relevant CVEs",
  "description": "Vulnerabilities whose impact is availability through resource exhaustion or amplification. Status, publication date and CVSS read from each NVD record. No exploitation detail.",
  "lastUpdated": "2026-08-15",
  "license": "Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.",
  "sources": [
    {
      "id": "nvd",
      "title": "National Vulnerability Database (NVD) CVE API",
      "publisher": "NIST",
      "url": "https://nvd.nist.gov/",
      "accessedDate": "2026-08-15",
      "notes": "Each row was fetched individually from the NVD 2.0 API; status and CVSS values are as NVD recorded them on the access date."
    }
  ],
  "changelog": [
    {
      "date": "2026-08-15",
      "note": "Initial release: nine availability-impacting CVEs, each read from its NVD record."
    }
  ],
  "rowCount": 9,
  "data": [
    {
      "cve": "CVE-2023-44487",
      "affects": "HTTP/2 protocol implementations, broadly",
      "ddosRelevance": "Rapid Reset: rapid stream open-and-cancel consumes server request handling. The vector behind the 2023 record requests-per-second attacks.",
      "published": "2023-10-10",
      "nvdStatus": "Analyzed",
      "cvss31": "7.5 HIGH",
      "remediation": "Patch the server; limit concurrent and cancelled streams per connection.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2023-44487"
    },
    {
      "cve": "CVE-2024-27316",
      "affects": "Apache HTTP Server (nghttp2 header buffering)",
      "ddosRelevance": "HTTP/2 header handling can be driven to exhaust memory — the CONTINUATION-flood class of availability bug.",
      "published": "2024-04-04",
      "nvdStatus": "Modified",
      "cvss31": "7.5 HIGH",
      "remediation": "Upgrade to a fixed Apache HTTP Server release.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2024-27316"
    },
    {
      "cve": "CVE-2019-9511",
      "affects": "Multiple HTTP/2 implementations",
      "ddosRelevance": "Window-size and stream-prioritisation manipulation leading to denial of service.",
      "published": "2019-08-13",
      "nvdStatus": "Modified",
      "cvss31": "7.5 HIGH",
      "remediation": "Vendor patches from the coordinated 2019 HTTP/2 disclosure.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2019-9511"
    },
    {
      "cve": "CVE-2019-9512",
      "affects": "Multiple HTTP/2 implementations",
      "ddosRelevance": "Ping flood: continuous pings force the server to queue responses.",
      "published": "2019-08-13",
      "nvdStatus": "Modified",
      "cvss31": "7.5 HIGH",
      "remediation": "Vendor patches from the coordinated 2019 HTTP/2 disclosure.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2019-9512"
    },
    {
      "cve": "CVE-2019-9513",
      "affects": "Multiple HTTP/2 implementations",
      "ddosRelevance": "Resource loop through repeated stream prioritisation changes.",
      "published": "2019-08-13",
      "nvdStatus": "Modified",
      "cvss31": "7.5 HIGH",
      "remediation": "Vendor patches from the coordinated 2019 HTTP/2 disclosure.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2019-9513"
    },
    {
      "cve": "CVE-2019-9514",
      "affects": "Multiple HTTP/2 implementations",
      "ddosRelevance": "Reset flood — the ancestor of the 2023 Rapid Reset class.",
      "published": "2019-08-13",
      "nvdStatus": "Modified",
      "cvss31": "7.5 HIGH",
      "remediation": "Vendor patches from the coordinated 2019 HTTP/2 disclosure.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2019-9514"
    },
    {
      "cve": "CVE-2019-9515",
      "affects": "Multiple HTTP/2 implementations",
      "ddosRelevance": "Settings flood: a stream of SETTINGS frames forces the server to respond.",
      "published": "2019-08-13",
      "nvdStatus": "Modified",
      "cvss31": "7.5 HIGH",
      "remediation": "Vendor patches from the coordinated 2019 HTTP/2 disclosure.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2019-9515"
    },
    {
      "cve": "CVE-2018-1000115",
      "affects": "Memcached 1.5.5 UDP support",
      "ddosRelevance": "Network amplification (CWE-406) — the exposure behind the extreme memcached amplification factors.",
      "published": "2018-03-05",
      "nvdStatus": "Modified",
      "cvss31": "not scored in CVSS v3.1 by NVD (v2 base score 5.0)",
      "remediation": "Do not expose memcached to the internet; disable UDP.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000115"
    },
    {
      "cve": "CVE-2016-10229",
      "affects": "Linux kernel before 4.5 (udp.c)",
      "ddosRelevance": "UDP traffic triggering an unsafe second checksum calculation — a kernel-level availability and integrity exposure on the packet path.",
      "published": "2017-04-04",
      "nvdStatus": "Modified",
      "cvss31": "9.8 CRITICAL",
      "remediation": "Run a kernel at or beyond the fixed version.",
      "source": "https://nvd.nist.gov/vuln/detail/CVE-2016-10229"
    }
  ]
}