nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | May 8, 2018 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2Upgrade libnghttp2Upgrade libnghttp2-develUpgrade nghttp2-debuginfo | Apr 27, 2020 | May 8, 2018 |
| Debian | — | Upgrade nghttp2 | Nov 29, 2021 | May 8, 2018 |
| Freebsd | — | Upgrade libnghttp2Upgrade node8Upgrade nodeUpgrade node6Upgrade nghttp2 | Jun 16, 2018 | Jun 15, 2018 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.32.0-11.4.2.0.1.1.0 on Solaris 11.4 | Oct 19, 2018 | May 8, 2018 |
| Suse | — | Upgrade firefox-libharfbuzz0Upgrade mozilla-nss-toolsUpgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-glib2-langUpgrade firefox-gtk3-immodule-inuktitutUpgrade mozilla-nss-develUpgrade MozillaFirefox-translations-otherUpgrade nodejs10Upgrade mozilla-nss-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade libnghttp2-develUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade MozillaFirefoxUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nsprUpgrade nodejs8-docsUpgrade mozilla-nspr-32bitUpgrade libfreebl3Upgrade firefox-gtk3-toolsUpgrade libnghttp2-14-32bitUpgrade mozilla-nss-certsUpgrade firefox-gtk3-immodule-thaiUpgrade libsoftokn3Upgrade firefox-libatk-1_0-0Upgrade libnghttp2_asio1Upgrade libnghttp2-14Upgrade firefox-gtk3-immodule-vietnameseUpgrade libnghttp2_asio-develUpgrade firefox-libffi4Upgrade libfreebl3-32bitUpgrade libsoftokn3-32bitUpgrade firefox-gio-branding-upstreamUpgrade nodejs8-develUpgrade firefox-gdk-pixbuf-langUpgrade libfirefox-gobject-2_0-0Upgrade firefox-libcairo2Upgrade firefox-libffi7Upgrade MozillaFirefox-translations-commonUpgrade npm8Upgrade mozilla-nss-certs-32bitUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-glib2-toolsUpgrade firefox-gtk3-dataUpgrade firefox-atk-langUpgrade nodejs10-develUpgrade firefox-gtk3-immodule-ximUpgrade mozilla-nssUpgrade libfirefox-gmodule-2_0-0Upgrade firefox-libgtk-3-0Upgrade nodejs10-docsUpgrade npm10Upgrade nodejs8Upgrade libfirefox-gthread-2_0-0Upgrade firefox-gtk3-langUpgrade firefox-libcairo-gobject2Upgrade mozilla-nspr-develUpgrade libfirefox-gio-2_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-glib-2_0-0Upgrade firefox-libpango-1_0-0 | May 20, 2018 | May 8, 2018 |
| Ubuntu | — | Upgrade nghttp2 | Nov 19, 2024 | May 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub