NG
Vendor
nghttp2
9
CVEs
1
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-58055 | NG nghttp2 nghttp2 | 5.4 | Jun 28 | nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length |
| CVE-2026-27135 | NG nghttp2 nghttp2 | 7.5 | Mar 18 | nghttp2 Denial of service: Assertion failure due to the missing state validation |
| CVE-2024-28182 | NG nghttp2 nghttp2 | 5.3 | Apr 4 | Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage |
| CVE-2023-44487 In wildKEV | NG Nghttp2 Nghttp2 | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability |
| CVE-2023-35945 | NG Nghttp2 Nghttp2 | 7.5 | Jul 13 | Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec |
| CVE-2020-11080 | NG Nghttp2 Nghttp2 | 7.5 | Jun 3 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service |
| CVE-2016-1544 | NG Nghttp2 Nghttp2 | 3.3 | Feb 6 | nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion) |
| CVE-2018-1000168 | NG Nghttp2 Nghttp2 | 7.5 | May 8 | nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading… |
| CVE-2015-8659 | NG Nghttp2 Nghttp2 | 10.0 | Jan 12 | The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug |