nghttp2 vulnerabilities
5 known CVE vulnerabilities in nghttp2, translated and rated.
- CVE-2024-28182Medium
The nghttp2 library prior to version 1.61.0 keeps reading an unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep the HPACK context in sync. This causes excessive CPU usage to decode HPACK state.
- CVE-2015-8659Critical
Idle stream handling in nghttp2 before version 1.6.0 contains a heap-use-after-free bug that can be exploited by attackers in unspecified ways.
- CVE-2026-58055Medium
A vulnerability in nghttp2 nghttpx up to version 1.69.0 causes an HTTP/1.1 Upgrade request with a Content-Length header and body to be forwarded onto reusable keep-alive backend connections. A backend interpreting this ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
- CVE-2026-24029Medium
When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPS frontend using the nghttp2 provider, the ACL check is skipped, allowing all clients to send DoH queries regardless of the configured ACL.
- CVE-2026-27135High
In nghttp2 library before version 1.68.1, missing internal state validation after calling `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` causes the library to continue reading incoming data. Receiving a malformed frame can trigger an assertion failure and crash.