Medium severity · published Apr 4, 2024
CVE-2024-28182
Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
5.3
CVSS
85%
EPSS
No
On KEV
Description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)85.0% · higher than 100% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NG
nghttp2 · nghttp2
< 1.61.0 · source: vendor, NVD, CISA
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
FE
Fedora · Fedoraproject
38; 39; 40 · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SN
SINEC NMS · Siemens
before V3.0 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28182
Mailing List
http://www.openwall.com/lists/oss-security/2024/04/03/16
Patch
https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
Patch
https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
Vendor Advisory
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
Mailing List
https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
More from nghttp2
7.5
CVE-2023-44487
HTTP/2 Rapid Reset Attack Vulnerability
10.0
CVE-2015-8659
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug
7.5
CVE-2026-27135
nghttp2 Denial of service: Assertion failure due to the missing state validation
7.5
CVE-2023-35945
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
7.5
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service