VDB

CISA-2024-28182

CISA-2024-28182 PUBLISHED CVSS 5.3 MEDIUM

Reported by GitHub_M · Published April 4, 2024

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Risk Scores

CVSS 3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products

VendorProductVersions
nghttp2nghttp2< 1.61.0
nghttp2nghttp20, 0
nghttp2nghttp2< 1.61.0, < 1.61.0

Timeline

  • Apr 4, 2024 CVE Published
  • Feb 13, 2025 CVE Updated

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›