CVE-2024-28182

2024-04-0400:00:00

ubuntu.com

nghttp2

vulnerability

excessive cpu usage

http/2

hpack

unix

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

13.3%

JSON

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2
in C. The nghttp2 library prior to version 1.61.0 keeps reading the
unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset
to keep HPACK context in sync. This causes excessive CPU usage to decode
HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the
number of CONTINUATION frames it accepts per stream. There is no workaround
for this vulnerability.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchnghttp2< 1.30.0-1ubuntu1+esm2UNKNOWN
ubuntu20.04noarchnghttp2< 1.40.0-1ubuntu0.3UNKNOWN
ubuntu22.04noarchnghttp2< 1.43.0-1ubuntu0.2UNKNOWN
ubuntu23.10noarchnghttp2< 1.55.1-1ubuntu0.2UNKNOWN
ubuntu24.04noarchnghttp2< 1.59.0-1ubuntu0.1UNKNOWN
ubuntu16.04noarchnghttp2< 1.7.1-1ubuntu0.1~esm2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	nghttp2	< 1.30.0-1ubuntu1+esm2	UNKNOWN
ubuntu	20.04	noarch	nghttp2	< 1.40.0-1ubuntu0.3	UNKNOWN
ubuntu	22.04	noarch	nghttp2	< 1.43.0-1ubuntu0.2	UNKNOWN
ubuntu	23.10	noarch	nghttp2	< 1.55.1-1ubuntu0.2	UNKNOWN
ubuntu	24.04	noarch	nghttp2	< 1.59.0-1ubuntu0.1	UNKNOWN
ubuntu	16.04	noarch	nghttp2	< 1.7.1-1ubuntu0.1~esm2	UNKNOWN