Vendors / nghttp2 Records 9 All Threatist records
Exploited (KEV) 1
CVSS critical 1
CVSS high 5
Exploited now nghttp2 records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 72
Envoy is a cloud-native high-performance edge/middle/service proxy.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01652 · Published 2023-07-13 · Fixed in 1.26.3, 1.25.8 +2 CWE-400
Priority HIGH 71
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.81994 · Published 2024-04-04 · Partial fix · 1.61.0 CWE-770
Priority MEDIUM 52
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.1058 · Published 2018-05-08 · Fixed CWE-476
Priority MEDIUM 50
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
CVSS 3.0 CRITICAL 10.0· Network · No auth · No interaction · EPSS 0.03964 · Published 2016-01-12 · No fix listed CWE-119
Priority MEDIUM 41
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.05316 · Published 2020-06-03 · Fixed in 1.41.0 CWE-707
Priority MEDIUM 40
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00823 · Published 2026-03-18 · Fixed in 1.68.1 CWE-617
Priority LOW 28
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers wh…
CVSS 4.0 MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00253 · Published 2026-06-28 · Partial fix CWE-444
Priority LOW 18
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
CVSS 3.1 LOW 3.3· Local · Low privileges · No interaction · EPSS 0.00886 · Published 2020-02-06 · Fixed in 1.7.1 CWE-400
Open these records in search → All records by CVSS severity
1 5 2 1 0
THREATIST.IORead the docs