CVE-2024-28182CWE-770denial-of-service

CVE-2024-28182

Medium · published April 4, 2024

Patch now

High probability of exploitation

CVSS calls it medium at 5.3. It sits in the 99.7th percentile for exploit probability.

CVSS v3.1
5.3
EPSS
85%
Percentile
99.7
In the wild
Unconfirmed
What it is

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.84960 · 99.7th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2024-04-04T19:15Z
Affected products (6)
ProductVersionsFixed in
nghttp2/nghttp2< 1.61.01.61.0
debian/debian_linuxall versions—
debian/debian_linuxall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
fedoraproject/fedoraall versions—
References (20)
http://www.openwall.com/lists/oss-security/2024/04/03/16 · [email protected]https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0 · [email protected]https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9 · [email protected]https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q · [email protected]https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/ · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/ · [email protected]https://lists.fedoraproject.org/archives/list/[email protected]/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/ · [email protected]http://www.openwall.com/lists/oss-security/2024/04/03/16 · af854a3a-2127-422b-91ae-364da2661108https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0 · af854a3a-2127-422b-91ae-364da2661108https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9 · af854a3a-2127-422b-91ae-364da2661108https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/ · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/[email protected]/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/ · af854a3a-2127-422b-91ae-364da2661108https://www.kb.cert.org/vuls/id/421644 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-784301.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 04 APR 14:41Z
    Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
    cvelistv5