CVE-2024-28182
MediumSummary
The nghttp2 library prior to version 1.61.0 keeps reading an unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep the HPACK context in sync. This causes excessive CPU usage to decode HPACK state.
Risk Assessment
A remote attacker can send a series of CONTINUATION frames, causing excessive CPU usage on the server, potentially leading to a denial of service (DoS).
Recommendation
Update nghttp2 to version 1.61.0 or later, which limits the number of CONTINUATION frames read after a stream reset.
Original NVD description (English source)
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK st