nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nodejs | Aug 22, 2024 | May 8, 2018 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2Upgrade libnghttp2-devel | Apr 27, 2020 | May 8, 2018 |
| Debian | — | Upgrade nghttp2 | Nov 29, 2021 | May 8, 2018 |
| Freebsd | — | Upgrade node8Upgrade nodeUpgrade libnghttp2Upgrade node6Upgrade nghttp2 | Jun 16, 2018 | Jun 15, 2018 |
| Oracle Solaris | — | Upgrade library/nghttp2 to version 1.32.0-11.4.2.0.1.1.0 on Solaris 11.4 | Oct 19, 2018 | May 8, 2018 |
| Suse | — | Upgrade mozilla-nss-certsUpgrade mozillafirefox-translations-otherUpgrade mozilla-nss-develUpgrade mozilla-nsprUpgrade nodejs8-docsUpgrade firefox-libgdk_pixbuf-2_0-0Upgrade firefox-gtk3-immodule-thaiUpgrade firefox-gtk3-toolsUpgrade mozilla-nss-32bitUpgrade firefox-gtk3-immodule-multipressUpgrade mozilla-nss-toolsUpgrade firefox-glib2-langUpgrade libnghttp2-develUpgrade nodejs10Upgrade libsoftokn3Upgrade mozillafirefox-translations-commonUpgrade firefox-gtk3-branding-upstreamUpgrade firefox-gtk3-immodule-inuktitutUpgrade libfreebl3Upgrade firefox-gtk3-immodules-tigrignaUpgrade firefox-libharfbuzz0Upgrade libnghttp2-14-32bitUpgrade mozilla-nspr-32bitUpgrade libfirefox-gthread-2_0-0Upgrade firefox-gdk-pixbuf-langUpgrade firefox-gio-branding-upstreamUpgrade nodejs8-develUpgrade firefox-libatk-1_0-0Upgrade firefox-libcairo-gobject2Upgrade mozilla-nspr-develUpgrade libsoftokn3-32bitUpgrade libfirefox-glib-2_0-0Upgrade firefox-gtk3-dataUpgrade mozillafirefox-branding-sledUpgrade firefox-libpango-1_0-0Upgrade firefox-gdk-pixbuf-thumbnailerUpgrade libfirefox-gobject-2_0-0Upgrade mozilla-nss-certs-32bitUpgrade libnghttp2_asio-develUpgrade mozillafirefoxUpgrade libfreebl3-32bitUpgrade libnghttp2_asio1Upgrade firefox-libffi4Upgrade firefox-glib2-toolsUpgrade firefox-gdk-pixbuf-query-loadersUpgrade firefox-gtk3-immodule-amharicUpgrade firefox-atk-langUpgrade libfirefox-gio-2_0-0Upgrade firefox-gtk3-immodule-ximUpgrade firefox-libcairo2Upgrade firefox-gtk3-langUpgrade firefox-libffi7Upgrade libnghttp2-14Upgrade mozilla-nssUpgrade nodejs10-develUpgrade firefox-gtk3-immodule-vietnameseUpgrade nodejs10-docsUpgrade npm10Upgrade firefox-libgtk-3-0Upgrade nodejs8Upgrade npm8Upgrade libfirefox-gmodule-2_0-0 | May 20, 2018 | May 8, 2018 |
| Ubuntu | — | Upgrade nghttp2 | Nov 19, 2024 | May 8, 2018 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 8, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub