CVE-2015-8659

Critical

Published: 12/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Idle stream handling in nghttp2 before version 1.6.0 contains a heap-use-after-free bug that can be exploited by attackers in unspecified ways.

This vulnerability may lead to unforeseen consequences, posing a threat to the integrity and availability of the system.

It is recommended to upgrade nghttp2 to version 1.6.0 or later to mitigate this vulnerability.

Original NVD description (English source)

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.