nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- CVSS 3.0 Base Score: 5.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-nginx | Nov 27, 2018 | Nov 7, 2018 | |
| Amazon_linux | — | amazon-linux-upgrade-nginx | Dec 15, 2018 | Nov 6, 2018 |
| Debian | debian-upgrade-nginx | Nov 9, 2018 | Nov 6, 2018 | |
| Freebsd | freebsd-upgrade-package-nginxfreebsd-upgrade-package-nginx-devel | Nov 7, 2018 | Nov 6, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-nginx | Dec 11, 2018 | Nov 7, 2018 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-nginxhuawei-euleros-2_0_sp8-upgrade-nginx-all-moduleshuawei-euleros-2_0_sp8-upgrade-nginx-filesystemhuawei-euleros-2_0_sp8-upgrade-nginx-mod-http-image-filterhuawei-euleros-2_0_sp8-upgrade-nginx-mod-http-perlhuawei-euleros-2_0_sp8-upgrade-nginx-mod-http-xslt-filterhuawei-euleros-2_0_sp8-upgrade-nginx-mod-mailhuawei-euleros-2_0_sp8-upgrade-nginx-mod-stream | Sep 30, 2019 | Nov 7, 2018 | |
| Nginx | nginx-nginx-upgrade-1_14_1nginx-nginx-upgrade-1_15_6 | Nov 7, 2018 | Nov 7, 2018 | |
| Suse | — | suse-upgrade-nginxsuse-upgrade-nginx-sourcesuse-upgrade-vim-plugin-nginx | Feb 19, 2019 | Nov 6, 2018 |
| Ubuntu | ubuntu-upgrade-nginx-commonubuntu-upgrade-nginx-coreubuntu-upgrade-nginx-extrasubuntu-upgrade-nginx-fullubuntu-upgrade-nginx-light | Nov 15, 2018 | Nov 6, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Nov 7, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub