Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

INFO

Published Date :

2024-04-04T14:41:36.587Z

Last Modified :

2025-11-04T18:30:26.332Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2024-28182 vulnerability.

Vendors Products
Debian
  • Debian Linux
Fedoraproject
  • Fedora
Nghttp2
  • Nghttp2
Redhat
  • Enterprise Linux
  • Jboss Core Services
  • Rhel Aus
  • Rhel E4s
  • Rhel Eus
  • Rhel Tus
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-28182.

URL Resource
http://www.openwall.com/lists/oss-security/2024/04/03/16 cve-icon cve-icon
https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0 cve-icon cve-icon
https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9 cve-icon cve-icon
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q cve-icon cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html cve-icon
https://lists.fedoraproject.org/archives/list/[email protected]/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/[email protected]/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/[email protected]/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/ cve-icon cve-icon
https://nowotarski.info/http2-continuation-flood/ cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-28182 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-28182 cve-icon
https://www.kb.cert.org/vuls/id/421644 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact