Skip to content
OpenAdvisories
Medium ELSA-2024-3501 1 CVE

Moderate: nghttp2 security update (Oracle Linux 9)

Published Jun 20, 2024 · Updated Jun 20, 2024

Ecosystem: Oracle Linux

Summary

[1.43.0-5.2]
- fix CONTINUATION frames DoS (CVE-2024-28182, CVE-2024-27316)

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 9 libnghttp2 0:1.43.0-5.el9_4.3
Oracle Linux · 9 libnghttp2-devel 0:1.43.0-5.el9_4.3
Oracle Linux · 9 nghttp2 0:1.43.0-5.el9_4.3

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-28182 EPSS 82%

    Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…

    nghttp2 nghttp2 rust nodejs Debian Ubuntu Azure Linux Wolfi