CVE-2024-28182 — Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Affected: nghttp2

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

USN-6754-1 — nghttp2 vulnerabilities

Affected: Ubuntu:Pro:16.04:LTS: nghttp2, Ubuntu:Pro:18.04:LTS: nghttp2, Ubuntu:20.04:LTS: nghttp2, Ubuntu:22.04:LTS: nghttp2

It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513)

It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)

Most recent entries from all

CVE-2024-28182 — Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

USN-6754-1 — nghttp2 vulnerabilities