nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade nodejs-nodemonUpgrade nodejs-full-i18nUpgrade nodejs-docsUpgrade nodejs-packagingUpgrade nodejs-develUpgrade nodejsUpgrade npmUpgrade nodejs-packaging-bundlerUpgrade libnghttp2-develUpgrade libnghttp2Upgrade nodejs-libsUpgrade nghttp2 | May 13, 2024 | Apr 4, 2024 |
| Amazon Linux Ami 2 | — | Upgrade nghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2-develUpgrade libnghttp2 | May 1, 2024 | Apr 4, 2024 |
| Amazon_linux | — | Upgrade nghttp2 | May 14, 2024 | Apr 4, 2024 |
| Amazon_linux_2023 | — | Upgrade nodejs20-docsUpgrade nodejs-debugsourceUpgrade nodejs-libs-debuginfoUpgrade nodejs-develUpgrade nodejs20-npmUpgrade nodejs20-develUpgrade nodejs-debuginfoUpgrade v8-11.3-develUpgrade nodejs-full-i18nUpgrade nodejs-npmUpgrade nghttp2-debugsourceUpgrade nodejs20-libsUpgrade nodejs-docsUpgrade libnghttp2Upgrade nodejs20-full-i18nUpgrade nodejsUpgrade nodejs20-debugsourceUpgrade libnghttp2-develUpgrade nghttp2Upgrade libnghttp2-debuginfoUpgrade nodejs20-libs-debuginfoUpgrade nghttp2-debuginfoUpgrade nodejs20-debuginfoUpgrade v8-10.2-develUpgrade nodejs-libsUpgrade nodejs20 | Feb 17, 2025 | Apr 3, 2024 |
| Debian | — | Upgrade nghttp2 | May 2, 2024 | Apr 4, 2024 |
| Dell Powerstore Dsa2024398 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Sep 17, 2024 |
| Dell Powerstore Dsa2024408 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Sep 26, 2024 |
| Dell Powerstore Dsa2024432 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Oct 29, 2024 |
| Gentoo Linux | — | Upgrade net-libs/nghttp2. | Aug 8, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libnghttp2 | Jul 16, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libnghttp2 | Jun 26, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libnghttp2 | Oct 8, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libnghttp2 | Jul 23, 2024 | Apr 4, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libnghttp2 | Jul 17, 2024 | Apr 4, 2024 |
| Oracle_linux | — | Upgrade nodejs-packagingUpgrade nodejs-full-i18nUpgrade nodejs-nodemonUpgrade nghttp2Upgrade nodejsUpgrade nodejs-libsUpgrade npmUpgrade libnghttp2Upgrade libnghttp2-develUpgrade nodejs-docsUpgrade nodejs-develUpgrade nodejs-packaging-bundler | May 9, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade libnghttp2-debuginfoUpgrade nodejsUpgrade nghttp2-debuginfoUpgrade nodejs-debuginfoUpgrade nodejs-libs-debuginfoUpgrade nodejs-packagingUpgrade nodejs-packaging-bundlerUpgrade nodejs-debugsourceUpgrade libnghttp2Upgrade nodejs-develNo solution existsUpgrade nodejs-docsUpgrade nghttp2Upgrade nodejs-full-i18nUpgrade nodejs-libsUpgrade libnghttp2-develUpgrade npmUpgrade nghttp2-debugsourceUpgrade nodejs-nodemon | May 13, 2024 | Apr 4, 2024 |
| Rocky_linux | — | Upgrade nodejs-libs-debuginfoUpgrade libnghttp2Upgrade nodejs-develUpgrade nodejs-debugsourceUpgrade nghttp2-debuginfoUpgrade nodejsUpgrade nghttp2-debugsourceUpgrade nodejs-debuginfoUpgrade nodejs-libsUpgrade nodejs-full-i18nUpgrade npmUpgrade libnghttp2-debuginfoUpgrade nghttp2Upgrade libnghttp2-devel | May 13, 2024 | Apr 4, 2024 |
| Suse | — | Upgrade libnghttp2-14Upgrade libnghttp2_asio1Upgrade libnghttp2_asio-develUpgrade nghttp2Upgrade python3-nghttp2Upgrade libnghttp2-14-32bitUpgrade libnghttp2_asio1-32bitUpgrade libnghttp2-devel | Apr 9, 2024 | Apr 4, 2024 |
| Ubuntu | — | Upgrade libnghttp2-14Upgrade nghttp2-serverUpgrade nghttp2-client (Ubuntu Pro)Upgrade nghttp2 (Ubuntu Pro)Upgrade nghttp2-server (Ubuntu Pro)Upgrade nghttp2-proxyUpgrade nghttp2Upgrade libnghttp2-14 (Ubuntu Pro)Upgrade nghttp2-proxy (Ubuntu Pro)Upgrade nghttp2-client | Apr 26, 2024 | Apr 4, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub