5.3
Medium
CVE-2024-28182 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
Description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nghttp2 1.61 | earliest → < 1.61.0 | 1.61.0 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SINEC NMS 3.0 | earliest → < 3.0 | 3.0 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.debian.org lists.debian.org
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of nghttp2
The 5 CVEs of nghttp2 →
CVE-2026-58055
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header…
5.4
Medium
CVE-2026-27135
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
7.5
High
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service
3.7
Low
CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion)
Not rated