Description
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nghttp2 | 1.31.1-1 | — |
| Debian 13 | nghttp2 | 1.31.1-1 | — |
| Debian 12 | nghttp2 | 1.31.1-1 | — |
| Debian 9 | nghttp2 | 1.18.1-1+deb9u2 | DLA-2786-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | nghttp2 | 1.30.0-1ubuntu1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss Core Services 1 | jbcs-httpd24 +1 | 1-6.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apache-commons-daemon-jsvc | 1:1.1.0-3.redhat_2.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr +1 | 1.6.3-31.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-apr-util +8 | 1.6.1-24.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.29-35.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_cluster-native | 1.3.8-3.Final_redhat_2.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_jk +2 | 1.2.46-1.redhat_1.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.29-35.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-nghttp2 +1 | 1.29.0-9.jbcs.el6 | RHSA-2019:0367 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.0.2n-14.jbcs.el6 | RHSA-2019:0367 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 | nodejs8 | 8.11.3-3.5.1 | SUSE-SU-2018:1918-1 |
| SLES 12 SP5 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP4 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP3 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES 12 SP2 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 11 SP4 | MozillaFirefox | 68.2.0-78.51.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | MozillaFirefox-branding-SLED | 68-21.9.8 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-atk | 2.26.1-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-cairo | 1.15.10-2.13.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gdk-pixbuf | 2.36.11-2.8.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-glib2 | 2.54.3-2.14.7 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-gtk3 | 3.10.9-2.15.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-harfbuzz | 1.7.5-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi | 3.2.1.git259-2.3.3 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-libffi-gcc5 | 5.3.1+r233831-14.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | firefox-pango | 1.40.14-2.7.4 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nspr | 4.21-29.6.1 | SUSE-SU-2019:14246-1 |
| SLES 11 SP4 | mozilla-nss | 3.45-38.9.3 | SUSE-SU-2019:14246-1 |
| SLES for SAP 12 SP5 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP4 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP3 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SLES for SAP 12 SP2 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud Crowbar 9 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud Crowbar 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 9 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE OpenStack Cloud 7 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
| SUSE HPE Helion OpenStack 8 | nghttp2 | 1.39.2-3.5.1 | SUSE-SU-2021:0932-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | nghttp2 | 1.43.0-1.6 | openSUSE-SU-2024:11091-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | nodejs | 8.11.3-r0 | — |
| Alpine v3.23 | nodejs | 8.11.3-r0 | — |
| Alpine v3.22 | nodejs | 8.11.3-r0 | — |
| Alpine v3.21 | nodejs | 8.11.3-r0 | — |
| Alpine v3.20 | nodejs | 8.11.3-r0 | — |
Show 12 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | nodejs | 8.11.3-r0 | — |
| Alpine v3.18 | nodejs | 8.11.3-r0 | — |
| Alpine v3.17 | nodejs | 8.11.3-r0 | — |
| Alpine v3.16 | nodejs | 8.11.3-r0 | — |
| Alpine v3.15 | nodejs | 8.11.3-r0 | — |
| Alpine v3.14 | nodejs | 8.11.3-r0 | — |
| Alpine v3.13 | nodejs | 8.11.3-r0 | — |
| Alpine v3.12 | nodejs | 8.11.3-r0 | — |
| Alpine v3.11 | nodejs | 8.11.3-r0 | — |
| Alpine v3.10 | nodejs | 8.11.3-r0 | — |
| Alpine v3.9 | nodejs | 8.11.3-r0 | — |
| Alpine v3.8 | nodejs | 8.11.3-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | nghttp2 +2 | 1.31.1-1.amzn2 | ALAS2-2018-1020 |
Advisories 7
- RHSA-2019:0367 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.29 security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- DLA-2786-1 nghttp2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2018:1918-1 Security update for nodejs8 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:0932-1 Security update for nghttp2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:14246-1 Security update for Mozilla Firefox SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11091-1 libnghttp2-14-1.43.0-1.6 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2-2018-1020 Moderate: nghttp2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 29, 2018
References
- RHSA-2019:0367 vendor-advisory
- https://nodejs.org/en/blog/vulnerability/june-2018-security-releases/
- 103952 vdb-entry
- https://nghttp2.org/blog/2018/04/12/nghttp2-v1-31-1/
- RHSA-2019:0366 vendor-advisory
- [debian-lts-announce] 20211017 [SECURITY] [DLA 2786-1] nghttp2 security update mailing-list