Skip to content
OpenAdvisories
Low USN-6142-1 1 CVE

nghttp2 vulnerability

Published Jun 6, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Gal Goldshtein discovered that nghttp2 incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS nghttp2 1.40.0-1ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS nghttp2 1.7.1-1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS nghttp2 1.30.0-1ubuntu1+esm1

Vulnerabilities 1

  • Low 3.7
    CVE-2020-11080

    Denial of service in nghttp2

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) o…

    nghttp2 nghttp2 nodejs nodejs Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2020-11080