vulnerability

Ubuntu: (CVE-2018-1000168): nghttp2 vulnerability

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

Published

May 8, 2018

Added

Nov 19, 2024

Modified

Apr 16, 2026

Description

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

Solution

ubuntu-upgrade-nghttp2

References

CVE-2018-100016
https://attackerkb.com/topics/CVE-2018-100016
CWE-20
CWE-476
EUVD-EUVD-2018-1868
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-1868
https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
https://www.cve.org/CVERecord?id=CVE-2018-1000168

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report