Medium severity5.3NVD Advisory· Published Apr 4, 2024· Updated Jun 17, 2026
CVE-2024-28182
CVE-2024-28182
Description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
50- osv-coords48 versionspkg:apk/chainguard/libnghttp2-14pkg:apk/chainguard/nghttp2pkg:apk/chainguard/nghttp2-devpkg:apk/chainguard/nghttp2-docpkg:apk/wolfi/libnghttp2-14pkg:apk/wolfi/nghttp2pkg:apk/wolfi/nghttp2-devpkg:apk/wolfi/nghttp2-docpkg:rpm/almalinux/libnghttp2pkg:rpm/almalinux/libnghttp2-develpkg:rpm/almalinux/nghttp2pkg:rpm/almalinux/nodejspkg:rpm/almalinux/nodejs-develpkg:rpm/almalinux/nodejs-docspkg:rpm/almalinux/nodejs-full-i18npkg:rpm/almalinux/nodejs-libspkg:rpm/almalinux/nodejs-nodemonpkg:rpm/almalinux/nodejs-packagingpkg:rpm/almalinux/nodejs-packaging-bundlerpkg:rpm/almalinux/npmpkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%20Micro%205.3pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Leap%20Micro%205.4pkg:rpm/opensuse/nghttp2&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/nghttp2-python&distro=openSUSE%20Leap%2015.5pkg:rpm/suse/nghttp2&distro=SUSE%20Enterprise%20Storage%207.1pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5pkg:rpm/suse/nghttp2&distro=SUSE%20Linux%20Micro%206.0pkg:rpm/suse/nghttp2&distro=SUSE%20Manager%20Proxy%204.3pkg:rpm/suse/nghttp2&distro=SUSE%20Manager%20Server%204.3
< 1.61.0-r0+ 47 more
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.61.0-r0
- (no CPE)range: < 1.43.0-5.el9_4.3
- (no CPE)range: < 1.43.0-5.el9_4.3
- (no CPE)range: < 1.43.0-5.el9_4.3
- (no CPE)range: < 1:20.12.2-2.module_el8.9.0+3827+11b91f3e
- (no CPE)range: < 1:20.12.2-2.module_el8.9.0+3827+11b91f3e
- (no CPE)range: < 1:20.12.2-2.module_el8.9.0+3827+11b91f3e
- (no CPE)range: < 1:20.12.2-2.module_el8.9.0+3827+11b91f3e
- (no CPE)range: < 1:16.20.2-8.el9_4
- (no CPE)range: < 3.0.1-1.module_el8.9.0+3731+490e3ce5
- (no CPE)range: < 2021.06-4.module_el8.9.0+3684+11b9e959
- (no CPE)range: < 2021.06-4.module_el8.9.0+3684+11b9e959
- (no CPE)range: < 1:10.5.0-1.20.12.2.2.module_el8.9.0+3827+11b91f3e
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.61.0-1.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.39.2-3.18.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.39.2-3.18.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.39.2-3.18.1
- (no CPE)range: < 1.52.0-5.1
- (no CPE)range: < 1.40.0-150200.17.1
- (no CPE)range: < 1.40.0-150200.17.1
Patches
Vulnerability mechanics
References
10- github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0nvdPatch
- github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9nvdPatch
- www.openwall.com/lists/oss-security/2024/04/03/16nvdMailing ListThird Party Advisory
- github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57qnvdVendor Advisory
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/nvdMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/nvdMailing ListThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/nvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2024/04/msg00026.htmlnvdMailing List
- lists.debian.org/debian-lts-announce/2024/09/msg00041.htmlnvdMailing List
- www.kb.cert.org/vuls/id/421644nvd
News mentions
0No linked articles in our index yet.