Nghttp2

Nghttp2

7 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2024-28182

  • EPSS 24.97%
  • Published 04.04.2024 15:15:38
  • Last modified 02.09.2025 15:49:02

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. ...

7.5

CVE-2023-44487

Warning Media report Exploit
  • EPSS 94.44%
  • Published 10.10.2023 14:15:10
  • Last modified 11.06.2025 17:29:54

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

7.5

CVE-2023-35945

  • EPSS 0.13%
  • Published 13.07.2023 21:15:08
  • Last modified 21.11.2024 08:09:01

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cle...

7.5

CVE-2020-11080

  • EPSS 0.74%
  • Published 03.06.2020 23:15:11
  • Last modified 21.11.2024 04:56:44

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings e...

3.3

CVE-2016-1544

  • EPSS 2.12%
  • Published 06.02.2020 15:15:11
  • Last modified 21.11.2024 02:46:36

nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).

7.5

CVE-2018-1000168

  • EPSS 4.08%
  • Published 08.05.2018 15:29:00
  • Last modified 09.06.2025 16:15:27

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network...

10

CVE-2015-8659

  • EPSS 2.19%
  • Published 12.01.2016 19:59:13
  • Last modified 12.04.2025 10:46:40

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.