Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-94sx-qnsn-5ucm
Vulnerability ID VCID-94sx-qnsn-5ucm
Aliases CVE-2024-28182
Summary Multiple vulnerabilities have been discovered in nghttp2, the worst of which could lead to a denial of service.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-390 Detection of Error Condition Without Action
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.24971 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.3 https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
ssvc Track https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
cvssv3.1 5.3 https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
ssvc Track https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
cvssv3.1 5.3 https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
ssvc Track https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
cvssv3.1 5.3 https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
cvssv3.1 5.3 http://www.openwall.com/lists/oss-security/2024/04/03/16
ssvc Track http://www.openwall.com/lists/oss-security/2024/04/03/16
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
https://api.first.org/data/v1/epss?cve=CVE-2024-28182
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28182
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
00201ecd8f982da3b67d4f6868af72a1b03b14e0 https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
1068415 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068415
2268639 https://bugzilla.redhat.com/show_bug.cgi?id=2268639
AGOME6ZXJG7664IPQNVE3DL67E3YP3HY https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
d71a4668c6bead55805d18810d633fbb98315af9 https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
GHSA-x6x3-gv8h-m57q https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
GLSA-202408-10 https://security.gentoo.org/glsa/202408-10
J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
msg00026.html https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693
RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694
RHSA-2024:2778 https://access.redhat.com/errata/RHSA-2024:2778
RHSA-2024:2779 https://access.redhat.com/errata/RHSA-2024:2779
RHSA-2024:2780 https://access.redhat.com/errata/RHSA-2024:2780
RHSA-2024:2853 https://access.redhat.com/errata/RHSA-2024:2853
RHSA-2024:2910 https://access.redhat.com/errata/RHSA-2024:2910
RHSA-2024:2937 https://access.redhat.com/errata/RHSA-2024:2937
RHSA-2024:3501 https://access.redhat.com/errata/RHSA-2024:3501
RHSA-2024:3544 https://access.redhat.com/errata/RHSA-2024:3544
RHSA-2024:3665 https://access.redhat.com/errata/RHSA-2024:3665
RHSA-2024:3701 https://access.redhat.com/errata/RHSA-2024:3701
RHSA-2024:3763 https://access.redhat.com/errata/RHSA-2024:3763
RHSA-2024:3875 https://access.redhat.com/errata/RHSA-2024:3875
RHSA-2024:4252 https://access.redhat.com/errata/RHSA-2024:4252
RHSA-2024:4576 https://access.redhat.com/errata/RHSA-2024:4576
RHSA-2024:4721 https://access.redhat.com/errata/RHSA-2024:4721
RHSA-2024:4732 https://access.redhat.com/errata/RHSA-2024:4732
RHSA-2024:4824 https://access.redhat.com/errata/RHSA-2024:4824
USN-6754-1 https://usn.ubuntu.com/6754-1/
USN-6754-2 https://usn.ubuntu.com/6754-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Exploit Prediction Scoring System (EPSS)
Percentile 0.96136
EPSS Score 0.24971
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T13:02:19.920216+00:00 Gentoo Importer Import https://security.gentoo.org/glsa/202408-10 38.0.0