Red Hat Security Advisory

RHSA-2023:6746

nghttp2 security update

Released 2023-11-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) libnghttp2-devel-1.43.0-5.el9_3.1, nghttp2-1.43.0-5.el9_3.1
Red Hat Enterprise Linux BaseOS (v. 9) libnghttp2-1.43.0-5.el9_3.1, nghttp2-1.43.0-5.el9_3.1

Fixes 1 record

TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3

The HTTP/2 protocol allows a denial of service (server resource consumption) because…

CRITICAL 90KEV

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.99999 Published 2023-10-10 Partial fix · 1.28.0, 0.17.0 +9 CWE-400