Vulnerability · Published Apr 4, 2024 · Assigned by GitHub_M
CVE-2024-28182Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
Medium 5.3
In plain English
A medium-severity resource allocation without limits in nghttp2 from nghttp2. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 82.0% (higher than 99.7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)82.0%top 0.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libnghttp2 | 1.33.0-6.el8_10.1 | ALSA-2024:4252 |
| AlmaLinux:9 | libnghttp2 | 1.43.0-5.el9_4.3 | ALSA-2024:3501 |
| AlmaLinux:8 | libnghttp2-devel | 1.33.0-6.el8_10.1 | ALSA-2024:4252 |
| AlmaLinux:9 | libnghttp2-devel | 1.43.0-5.el9_4.3 | ALSA-2024:3501 |
| AlmaLinux:8 | nghttp2 | 1.33.0-6.el8_10.1 | ALSA-2024:4252 |
| AlmaLinux:9 | nghttp2 | 1.43.0-5.el9_4.3 | ALSA-2024:3501 |
| AlmaLinux:8 | nodejs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:8 | nodejs-devel | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-devel | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-devel | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-devel | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-docs | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-docs | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-docs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs-docs | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-docs | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-full-i18n | 1:20.12.2-2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-full-i18n | 1:18.20.2-1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-full-i18n | 1:20.12.2-2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-full-i18n | 1:18.20.2-2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| AlmaLinux:9 | nodejs-full-i18n | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | nodejs-libs | 1:16.20.2-8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.8.0+3613+1ed8c91d | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-nodemon | 3.0.1-1.module_el8.9.0+3731+490e3ce5 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.3.0+47+c33bc288 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-nodemon | 3.0.1-1.module_el9.2.0+36+853e48f5 | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:8 | nodejs-packaging | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-packaging | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.7.0+3343+ea2b7901 | ALSA-2024:2780 |
| AlmaLinux:8 | nodejs-packaging-bundler | 2021.06-4.module_el8.9.0+3684+11b9e959 | ALSA-2024:2778 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.3.0+88+29afeaa2 | ALSA-2024:2853 |
| AlmaLinux:9 | nodejs-packaging-bundler | 2021.06-4.module_el9.1.0+13+d9a595ea | ALSA-2024:2779 |
| AlmaLinux:8 | npm | 1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644 | ALSA-2024:2780 |
| AlmaLinux:8 | npm | 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e | ALSA-2024:2778 |
| AlmaLinux:9 | npm | 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528 | ALSA-2024:2853 |
| AlmaLinux:9 | npm | 1:8.19.4-1.16.20.2.8.el9_4 | ALSA-2024:2910 |
| AlmaLinux:9 | npm | 1:10.5.0-1.18.20.2.2.module_el9.4.0+99+a01f7676 | ALSA-2024:2779 |
| Debian:12 | nghttp2 | 1.52.0-1+deb12u2 | DEBIAN-CVE-2024-28182 |
| Debian:13 | nghttp2 | 1.61.0-1 | DEBIAN-CVE-2024-28182 |
| Debian:14 | nghttp2 | 1.61.0-1 | DEBIAN-CVE-2024-28182 |
| Rocky Linux:8 | nghttp2 | 0:1.33.0-6.el8_10.1 | RLSA-2024:4252 |
| Rocky Linux:9 | nghttp2 | 0:1.43.0-5.el9_4.3 | RLSA-2024:3501 |
| Rocky Linux:8 | nodejs | 1:20.12.2-2.module+el8.9.0+1804+2708cc21 | RLSA-2024:2778 |
| Rocky Linux:8 | nodejs | 1:18.20.2-1.module+el8.9.0+1803+9ac8b495 | RLSA-2024:2780 |
| Rocky Linux:9 | nodejs | 1:16.20.2-8.el9_4 | RLSA-2024:2910 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2780 |
| Rocky Linux:8 | nodejs-nodemon | 0:3.0.1-1.module+el8.8.0+1459+02651ab6 | RLSA-2024:2778 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-nodemon | 0:3.0.1-1.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2778 |
| Rocky Linux:8 | nodejs-packaging | 0:2021.06-4.module+el8.7.0+1072+5b168780 | RLSA-2024:2780 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32185+bd121a25 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32143+ae966e5b | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32048+5323bb50 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32144+1d29a396 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2853 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32322+a8b1fd01 | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.6.0+32045+2e5d342d | RLSA-2024:2779 |
| Rocky Linux:9 | nodejs-packaging | 0:2021.06-4.module+el9.5.0+31770+0da7192d | RLSA-2024:2779 |
| Ubuntu:22.04:LTS | nghttp2 | 1.43.0-1ubuntu0.2 | USN-6754-1 |
| Ubuntu:22.04:LTS | nghttp2 | 1.43.0-1ubuntu0.2 | UBUNTU-CVE-2024-28182 |
| Ubuntu:24.04:LTS | nghttp2 | 1.59.0-1ubuntu0.1 | UBUNTU-CVE-2024-28182 |
| Ubuntu:24.04:LTS | nghttp2 | 1.59.0-1ubuntu0.1 | USN-6754-2 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q x_refsource_CONFIRM
- https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0 x_refsource_MISC
- https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9 x_refsource_MISC
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
- https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
- http://www.openwall.com/lists/oss-security/2024/04/03/16
- https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html
- https://www.kb.cert.org/vuls/id/421644
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-784301.html