The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | May 8, 2018 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade libnghttp2Upgrade nghttp2Upgrade libnghttp2-devel | Apr 27, 2020 | May 8, 2018 |
| Debian | — | Upgrade nghttp2 | Nov 29, 2021 | May 8, 2018 |
| Freebsd | — | Upgrade node8Upgrade node6Upgrade nodeUpgrade libnghttp2Upgrade nghttp2 | Jun 16, 2018 | Jun 15, 2018 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.32.0-11.4.2.0.1.1.0 on Solaris 11.4 | Oct 19, 2018 | May 8, 2018 |
| Suse | — | Upgrade libfirefox-gobject-2_0-0Upgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gtk3-langUpgrade firefox-libatk-1_0-0Upgrade libnghttp2_asio1Upgrade libnghttp2_asio-develUpgrade libfreebl3-32bitUpgrade firefox-gtk3-immodule-ximUpgrade firefox-gdk-pixbuf-query-loadersUpgrade mozilla-nspr-develUpgrade firefox-libcairo2Upgrade nodejs8Upgrade firefox-libcairo-gobject2Upgrade mozilla-nss-certs-32bitUpgrade nodejs8-develUpgrade firefox-gio-branding-upstreamUpgrade firefox-glib2-toolsUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi4Upgrade nodejs10-docsUpgrade MozillaFirefox-translations-commonUpgrade libsoftokn3-32bitUpgrade libfirefox-gmodule-2_0-0Upgrade npm10Upgrade libnghttp2-14Upgrade firefox-libgtk-3-0Upgrade nodejs10-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-libffi7Upgrade libfirefox-gio-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-dataUpgrade libfirefox-glib-2_0-0Upgrade mozilla-nssUpgrade firefox-atk-langUpgrade npm8Upgrade libsoftokn3Upgrade libfreebl3Upgrade firefox-gtk3-immodule-multipressUpgrade libnghttp2-develUpgrade mozilla-nss-32bitUpgrade MozillaFirefoxUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefox-translations-otherUpgrade mozilla-nss-develUpgrade nodejs10Upgrade firefox-glib2-langUpgrade mozilla-nss-toolsUpgrade libnghttp2-14-32bitUpgrade mozilla-nspr-32bitUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-immodule-inuktitutUpgrade nodejs8-docsUpgrade firefox-libharfbuzz0Upgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-thaiUpgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr | May 20, 2018 | May 8, 2018 |
| Ubuntu | — | Upgrade nghttp2 | Nov 19, 2024 | May 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 8, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub