Search for vulnerabilities
Vulnerability details: VCID-yxm9-ukxx-j7bd
Vulnerability ID VCID-yxm9-ukxx-j7bd
Aliases CVE-2024-28182
Summary nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Status Published
Exploitability 0.5
Weighted Severity 4.8
Risk 2.4
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-390 Detection of Error Condition Without Action
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18536 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
epss 0.18934 https://api.first.org/data/v1/epss?cve=CVE-2024-28182
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.3 https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
ssvc Track https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
cvssv3.1 5.3 https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
ssvc Track https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
cvssv3.1 5.3 https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
ssvc Track https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
cvssv3.1 5.3 https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
ssvc Track https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
ssvc Track https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
cvssv3.1 5.3 http://www.openwall.com/lists/oss-security/2024/04/03/16
ssvc Track http://www.openwall.com/lists/oss-security/2024/04/03/16
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
https://api.first.org/data/v1/epss?cve=CVE-2024-28182
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28182
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2024/09/msg00041.html
http://www.openwall.com/lists/oss-security/2024/04/03/16
00201ecd8f982da3b67d4f6868af72a1b03b14e0 https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
1068415 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068415
2268639 https://bugzilla.redhat.com/show_bug.cgi?id=2268639
AGOME6ZXJG7664IPQNVE3DL67E3YP3HY https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
CVE-2024-28182 https://nvd.nist.gov/vuln/detail/CVE-2024-28182
d71a4668c6bead55805d18810d633fbb98315af9 https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
GHSA-x6x3-gv8h-m57q https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
msg00026.html https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
RHSA-2024:2693 https://access.redhat.com/errata/RHSA-2024:2693
RHSA-2024:2694 https://access.redhat.com/errata/RHSA-2024:2694
RHSA-2024:2778 https://access.redhat.com/errata/RHSA-2024:2778
RHSA-2024:2779 https://access.redhat.com/errata/RHSA-2024:2779
RHSA-2024:2780 https://access.redhat.com/errata/RHSA-2024:2780
RHSA-2024:2853 https://access.redhat.com/errata/RHSA-2024:2853
RHSA-2024:2910 https://access.redhat.com/errata/RHSA-2024:2910
RHSA-2024:2937 https://access.redhat.com/errata/RHSA-2024:2937
RHSA-2024:3501 https://access.redhat.com/errata/RHSA-2024:3501
RHSA-2024:3544 https://access.redhat.com/errata/RHSA-2024:3544
RHSA-2024:3665 https://access.redhat.com/errata/RHSA-2024:3665
RHSA-2024:3701 https://access.redhat.com/errata/RHSA-2024:3701
RHSA-2024:3763 https://access.redhat.com/errata/RHSA-2024:3763
RHSA-2024:3875 https://access.redhat.com/errata/RHSA-2024:3875
RHSA-2024:4252 https://access.redhat.com/errata/RHSA-2024:4252
RHSA-2024:4576 https://access.redhat.com/errata/RHSA-2024:4576
RHSA-2024:4721 https://access.redhat.com/errata/RHSA-2024:4721
RHSA-2024:4732 https://access.redhat.com/errata/RHSA-2024:4732
RHSA-2024:4824 https://access.redhat.com/errata/RHSA-2024:4824
USN-6754-1 https://usn.ubuntu.com/6754-1/
USN-6754-2 https://usn.ubuntu.com/6754-2/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-28182.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00026.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2024-04-04T17:15:08Z/ Found at http://www.openwall.com/lists/oss-security/2024/04/03/16
Exploit Prediction Scoring System (EPSS)
Percentile 0.94978
EPSS Score 0.18536
Published At Aug. 15, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:42:38.308204+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/6754-2/ 37.0.0