5.3
Moyenne
CVE-2024-28182 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
Description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| nghttp2 1.61 | premières → < 1.61.0 | 1.61.0 |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SINEC NMS 3.0 | premières → < 3.0 | 3.0 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.fedoraproject.org lists.fedoraproject.org
- lists.debian.org lists.debian.org
- www.openwall.com www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de nghttp2
Les 5 CVE de nghttp2 →
CVE-2026-58055
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header…
5.4
Moyenne
CVE-2026-27135
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
7.5
Élevée
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service
3.7
Faible
CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion)
Non notée