CVE-2024-28182
MediumSummary
The nghttp2 library prior to version 1.61.0 keeps reading an unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep the HPACK context in sync. This causes excessive CPU usage to decode HPACK state.
Risk Assessment
A remote attacker can send a series of CONTINUATION frames, causing excessive CPU usage on the server, potentially leading to a denial of service (DoS).
Recommendation
Update nghttp2 to version 1.61.0 or later, which limits the number of CONTINUATION frames read after a stream reset.
Other vulnerabilities in nghttp2
See all- CVE-2015-8659Critical
Idle stream handling in nghttp2 before version 1.6.0 contains a heap-use-after-free bug that can be exploited by attackers in unspecified ways.
- CVE-2026-58055Medium
A vulnerability in nghttp2 nghttpx up to version 1.69.0 causes an HTTP/1.1 Upgrade request with a Content-Length header and body to be forwarded onto reusable keep-alive backend connections. A backend interpreting this ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
- CVE-2026-24029Medium
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPS frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
- CVE-2026-27135High
In nghttp2 library before version 1.68.1, missing internal state validation after calling `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` causes the library to continue reading incoming data. Receiving a malformed frame can trigger an assertion failure and crash.
Original NVD description (English source)
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK st
Vulnerability data from NVD (NIST) · CISA KEV · EPSS