Skip to content
OpenAdvisories
Medium ELSA-2024-4252 1 CVE

Moderate: nghttp2 security update (Oracle Linux 8)

Published Jul 2, 2024 · Updated Jul 2, 2024

Ecosystem: Oracle Linux

Summary

[1.33.0-6.1]
- fix CONTINUATION frames DoS (CVE-2024-27316)

[1.33.0-6]
- fix CONTINUATION frames DoS (CVE-2024-28182)

Fixed packages 3

ReleasePackageFixed in
Oracle Linux · 8 libnghttp2 0:1.33.0-6.el8_10.1
Oracle Linux · 8 libnghttp2-devel 0:1.33.0-6.el8_10.1
Oracle Linux · 8 nghttp2 0:1.33.0-6.el8_10.1

Vulnerabilities 1

  • Medium 5.3
    CVE-2024-28182 EPSS 82%

    Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…

    nghttp2 nghttp2 rust nodejs Debian Ubuntu Azure Linux Wolfi