CVE-2024-28182 — Allocation of Resources Without Limits or Throttling in Nghttp2

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-390 — Detection of Error Condition Without Action16 documents10 sources
Severity
5.3MEDIUMNVD
OSV7.5
EPSS
25.0%
top 3.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Nghttp2Debian LinuxFedoraproject Fedora
Timeline
PublishedApr 4
Latest updateOct 15

Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶CVEListV5nghttp2/nghttp2< 1.61.0
▶NVDnghttp2/nghttp2< 1.61.0
▶Debiannghttp2/nghttp2< 1.43.0-1+deb11u2+3
▶Ubuntunghttp2/nghttp2< 1.40.0-1ubuntu0.3+4

Also affects: Debian Linux 10.0, 11.0, Fedora 38, 39, 40

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
nghttp2 vulnerability↗2024-05-07
▶
OSV
nghttp2 vulnerabilities↗2024-04-25
▶
OSV
CVE-2024-28182: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C↗2024-04-04
▶
CVEList
Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage↗2024-04-04
▶

📋Vendor Advisories

10
Oracle
Oracle Oracle Communications Applications Risk Matrix: Installation (Nghttp2) — CVE-2024-28182↗2025-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Nghttp2) — CVE-2024-28182↗2025-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Security Framework (Nghttp2) — CVE-2024-28182↗2024-10-15
▶
CISA ICS
Siemens SINEC NMS↗2024-08-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install (Nghttp2) — CVE-2024-28182↗2024-07-15
▶

🕵️Threat Intelligence

1
Bleepingcomputer
New HTTP/2 DoS attack can crash web servers with a single connection↗2024-04-04
▶
CVE-2024-28182 — Nghttp2 vulnerability | cvebase