Skip to content
OpenAdvisories
High ALSA-2020:2755 1 CVE

Important: nghttp2 security update

Published Jun 25, 2020 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

* nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 8 libnghttp2 1.33.0-3.el8_2.1
AlmaLinux · 8 libnghttp2-devel 1.33.0-3.el8_2.1
AlmaLinux · 8 nghttp2 1.33.0-3.el8_2.1

Vulnerabilities 1

  • Low 3.7
    CVE-2020-11080

    Denial of service in nghttp2

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

    nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine

References

  • report
    https://vulners.com/cve/CVE-2020-11080