nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | May 8, 2018 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2Upgrade libnghttp2-devel | Apr 27, 2020 | May 8, 2018 |
| Debian | — | Upgrade nghttp2 | Nov 29, 2021 | May 8, 2018 |
| Freebsd | — | Upgrade nodeUpgrade libnghttp2Upgrade node6Upgrade node8Upgrade nghttp2 | Jun 16, 2018 | Jun 15, 2018 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.32.0-11.4.2.0.1.1.0 on Solaris 11.4 | Oct 19, 2018 | May 8, 2018 |
| Suse | — | Upgrade libfirefox-gmodule-2_0-0Upgrade nodejs10-develUpgrade libnghttp2-14Upgrade mozilla-nssUpgrade nodejs8-develUpgrade firefox-gdk-pixbuf-langUpgrade firefox-libffi4Upgrade libfirefox-glib-2_0-0Upgrade libsoftokn3-32bitUpgrade libfreebl3-32bitUpgrade nodejs10-docsUpgrade firefox-gtk3-langUpgrade nodejs8Upgrade firefox-libatk-1_0-0Upgrade MozillaFirefox-translations-commonUpgrade firefox-gtk3-immodule-vietnameseUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-dataUpgrade npm10Upgrade firefox-gtk3-immodule-ximUpgrade libnghttp2_asio-develUpgrade mozilla-nss-certs-32bitUpgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade firefox-libgtk-3-0Upgrade libnghttp2_asio1Upgrade libfirefox-gobject-2_0-0Upgrade firefox-gtk3-immodule-amharicUpgrade firefox-glib2-toolsUpgrade npm8Upgrade firefox-atk-langUpgrade firefox-gio-branding-upstreamUpgrade firefox-libcairo2Upgrade mozilla-nspr-develUpgrade firefox-libffi7Upgrade firefox-libcairo-gobject2Upgrade libfirefox-gio-2_0-0Upgrade libfirefox-gthread-2_0-0Upgrade mozilla-nss-certsUpgrade firefox-gtk3-immodules-tigrignaUpgrade libnghttp2-14-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-toolsUpgrade firefox-gtk3-immodule-inuktitutUpgrade firefox-gtk3-immodule-thaiUpgrade mozilla-nsprUpgrade mozilla-nss-develUpgrade MozillaFirefox-translations-otherUpgrade nodejs10Upgrade firefox-gtk3-branding-upstreamUpgrade firefox-glib2-langUpgrade MozillaFirefoxUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-libharfbuzz0Upgrade nodejs8-docsUpgrade libfreebl3Upgrade mozilla-nss-toolsUpgrade MozillaFirefox-branding-SLEDUpgrade libnghttp2-develUpgrade mozilla-nspr-32bitUpgrade libsoftokn3 | May 20, 2018 | May 8, 2018 |
| Ubuntu | — | Upgrade nghttp2 | Nov 19, 2024 | May 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub