Skip to content
OpenAdvisories
High 1 exploited CVE USN-6754-1 4 CVEs

nghttp2 vulnerabilities

Published Apr 25, 2024 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that nghttp2 incorrectly handled the HTTP/2
implementation. A remote attacker could possibly use this issue to cause
nghttp2 to consume resources, leading to a denial of service. This issue
only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511,
CVE-2019-9513)

It was discovered that nghttp2 incorrectly handled request cancellation. A
remote attacker could possibly use this issue to cause nghttp2 to consume
resources, leading to a denial of service. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487)

It was discovered that nghttp2 could be made to process an unlimited number
of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this
issue to cause nghttp2 to consume resources, leading to a denial of
service. (CVE-2024-28182)

Fixed packages 4

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS nghttp2 1.40.0-1ubuntu0.3
Ubuntu · 22.04 LTS 22.04:LTS nghttp2 1.43.0-1ubuntu0.2
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS nghttp2 1.7.1-1ubuntu0.1~esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS nghttp2 1.30.0-1ubuntu1+esm2

Vulnerabilities 4

  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023
  • High 7.5
    CVE-2019-9511 Public exploit EPSS 60%

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manip…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • High 7.5
    CVE-2019-9513 Public exploit EPSS 82%

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service

    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority…

    nodejs nodejs nodejs nginx Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2024-28182 EPSS 82%

    Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This cause…

    nghttp2 nghttp2 rust nodejs Debian Ubuntu Azure Linux Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2019-9511
  • report
    https://ubuntu.com/security/CVE-2019-9513
  • report
    https://ubuntu.com/security/CVE-2023-44487
  • report
    https://ubuntu.com/security/CVE-2024-28182