Skip to content
OpenAdvisories
High DLA-2786-1 2 CVEs

nghttp2 - security update

Published Oct 16, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 nghttp2 1.18.1-1+deb9u2

Vulnerabilities 2

  • High 7.5
    CVE-2018-1000168 EPSS 11%

    nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC f…

    nodejs nghttp2 nghttp2 Debian Ubuntu Alpine
  • Low 3.7
    CVE-2020-11080

    Denial of service in nghttp2

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

    nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine