Search for vulnerabilities
Vulnerability details: VCID-pm5s-c2v9-aaag
Vulnerability ID VCID-pm5s-c2v9-aaag
Aliases CVE-2024-28182
Summary nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-390 Detection of Error Condition Without Action
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.00044 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.14669 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.14669 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.15002 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.19254 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.26012 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.42938 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.2 http://www.openwall.com/lists/oss-security/2024/04/03/16
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/04/03/16
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
https://api.first.org/data/v1/epss?cve=CVE-2024-28182
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28182
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
http://www.openwall.com/lists/oss-security/2024/04/03/16
1068415 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068415
2268639 https://bugzilla.redhat.com/show_bug.cgi?id=2268639
CVE-2024-28182 https://nvd.nist.gov/vuln/detail/CVE-2024-28182
GLSA-202408-10 https://security.gentoo.org/glsa/202408-10
RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693
RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694
RHSA-2024:2778 https://access.redhat.com/errata/RHSA-2024:2778
RHSA-2024:2779 https://access.redhat.com/errata/RHSA-2024:2779
RHSA-2024:2780 https://access.redhat.com/errata/RHSA-2024:2780
RHSA-2024:2853 https://access.redhat.com/errata/RHSA-2024:2853
RHSA-2024:2910 https://access.redhat.com/errata/RHSA-2024:2910
RHSA-2024:2937 https://access.redhat.com/errata/RHSA-2024:2937
RHSA-2024:3501 https://access.redhat.com/errata/RHSA-2024:3501
RHSA-2024:3544 https://access.redhat.com/errata/RHSA-2024:3544
RHSA-2024:3665 https://access.redhat.com/errata/RHSA-2024:3665
RHSA-2024:3701 https://access.redhat.com/errata/RHSA-2024:3701
RHSA-2024:3763 https://access.redhat.com/errata/RHSA-2024:3763
RHSA-2024:3875 https://access.redhat.com/errata/RHSA-2024:3875
RHSA-2024:4252 https://access.redhat.com/errata/RHSA-2024:4252
RHSA-2024:4576 https://access.redhat.com/errata/RHSA-2024:4576
RHSA-2024:4721 https://access.redhat.com/errata/RHSA-2024:4721
RHSA-2024:4732 https://access.redhat.com/errata/RHSA-2024:4732
RHSA-2024:4824 https://access.redhat.com/errata/RHSA-2024:4824
USN-6754-1 https://usn.ubuntu.com/6754-1/
USN-6754-2 https://usn.ubuntu.com/6754-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.14292
EPSS Score 0.00044
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:19:16.603678+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-28182 34.0.0rc4