Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
Priority HIGH 71CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 24 fixed, 2 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.
Summary
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.81994 99th percentileScored 2026-11-07
Fix Partial nghttp2 (nghttp2): 1.61.0Red Hat: 19 advisoriesRed Hat: 24 fixed, 2 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nghttp2 | nghttp2 | before 1.61.0 | 1.61.0 | Patch available | CNA |
- nghttp2 Vendornghttp2 Affected before 1.61.0 Fixed in 1.61.0 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:* | before 1.61.0 | Vulnerable | nghttp2 |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:* Versions before 1.61.0 Vulnerable ·nghttp2
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA nghttp2 (nghttp2) Fixed in 1.61.0
Red Hat 19 advisories
- RHSA-2024:4824 Released 2024-07-24 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.aarch64::nodejs:18, nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.ppc64le::nodejs:18, nodejs-1:18.19.1-3.module+el8.8.0+22005+6f8bb252.s390x::nodejs:18 +20
- RHSA-2024:4732 Released 2024-07-23 · Red Hat rating Moderatenghttp2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) libnghttp2-1.33.0-4.el8_4.2, nghttp2-1.33.0-4.el8_4.2
- Red Hat Enterprise Linux BaseOS E4S (v.8.4) libnghttp2-1.33.0-4.el8_4.2, nghttp2-1.33.0-4.el8_4.2
- Red Hat Enterprise Linux BaseOS TUS (v.8.4) libnghttp2-1.33.0-4.el8_4.2, nghttp2-1.33.0-4.el8_4.2
- RHSA-2024:4721 Released 2024-07-23 · Red Hat rating Moderatenodejs security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) nodejs-1:16.20.2-9.el9_0, nodejs-docs-1:16.20.2-9.el9_0, nodejs-full-i18n-1:16.20.2-9.el9_0 +2
Show 16 more Red Hat advisories
- RHSA-2024:4576 Released 2024-07-16 · Red Hat rating Moderatenghttp2 security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) libnghttp2-1.33.0-3.el8_2.3, nghttp2-1.33.0-3.el8_2.3
- RHSA-2024:4252 Released 2024-07-02 · Red Hat rating Moderatenghttp2 security update
- Red Hat Enterprise Linux BaseOS (v. 8) libnghttp2-1.33.0-6.el8_10.1, nghttp2-1.33.0-6.el8_10.1
- Red Hat Enterprise Linux CRB (v. 8) libnghttp2-devel-1.33.0-6.el8_10.1, nghttp2-1.33.0-6.el8_10.1
- RHSA-2024:3875 Released 2024-06-12 · Red Hat rating Moderatenghttp2 security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) libnghttp2-1.43.0-5.el9_0.3, nghttp2-1.43.0-5.el9_0.3
- RHSA-2024:3763 Released 2024-06-10 · Red Hat rating Moderatenghttp2 security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) libnghttp2-1.33.0-4.el8_6.2, nghttp2-1.33.0-4.el8_6.2
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) libnghttp2-1.33.0-4.el8_6.2, nghttp2-1.33.0-4.el8_6.2
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) libnghttp2-1.33.0-4.el8_6.2, nghttp2-1.33.0-4.el8_6.2
- RHSA-2024:3701 Released 2024-06-06 · Red Hat rating Moderatenghttp2 security update
- Red Hat CodeReady Linux Builder EUS (v.8.8) libnghttp2-devel-1.33.0-5.el8_8.1, nghttp2-1.33.0-5.el8_8.1
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) libnghttp2-1.33.0-5.el8_8.1, nghttp2-1.33.0-5.el8_8.1
- RHSA-2024:3665 Released 2024-06-06 · Red Hat rating Moderatenghttp2 security update
- Red Hat CodeReady Linux Builder EUS (v.9.2) libnghttp2-devel-1.43.0-5.el9_2.3, nghttp2-1.43.0-5.el9_2.3
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) libnghttp2-1.43.0-5.el9_2.3, nghttp2-1.43.0-5.el9_2.3
- RHSA-2024:3544 Released 2024-06-03 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs-1:18.20.2-2.module+el9.2.0+21812+f1e61652.aarch64::nodejs:18, nodejs-1:18.20.2-2.module+el9.2.0+21812+f1e61652.ppc64le::nodejs:18, nodejs-1:18.20.2-2.module+el9.2.0+21812+f1e61652.s390x::nodejs:18 +20
- RHSA-2024:3501 Released 2024-05-30 · Red Hat rating Moderatenghttp2 security update
- Red Hat Enterprise Linux BaseOS (v. 9) libnghttp2-1.43.0-5.el9_4.3, nghttp2-1.43.0-5.el9_4.3
- Red Hat Enterprise Linux CRB (v. 9) libnghttp2-devel-1.43.0-5.el9_4.3, nghttp2-1.43.0-5.el9_4.3
- RHSA-2024:2937 Released 2024-05-21 · Red Hat rating Importantnodejs security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) nodejs-1:16.20.2-5.el9_2.3, nodejs-docs-1:16.20.2-5.el9_2.3, nodejs-full-i18n-1:16.20.2-5.el9_2.3 +2
- RHSA-2024:2910 Released 2024-05-20 · Red Hat rating Importantnodejs security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:16.20.2-8.el9_4, nodejs-docs-1:16.20.2-8.el9_4, nodejs-full-i18n-1:16.20.2-8.el9_4 +2
- RHSA-2024:2853 Released 2024-05-15 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:20.12.2-2.module+el9.4.0+21731+46b5b8a7.aarch64::nodejs:20, nodejs-1:20.12.2-2.module+el9.4.0+21731+46b5b8a7.ppc64le::nodejs:20, nodejs-1:20.12.2-2.module+el9.4.0+21731+46b5b8a7.s390x::nodejs:20 +20
- RHSA-2024:2780 Released 2024-05-09 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:18.20.2-1.module+el8.9.0+21767+537f34ee.aarch64::nodejs:18, nodejs-1:18.20.2-1.module+el8.9.0+21767+537f34ee.ppc64le::nodejs:18, nodejs-1:18.20.2-1.module+el8.9.0+21767+537f34ee.s390x::nodejs:18 +20
- RHSA-2024:2778 Released 2024-05-09 · Red Hat rating Importantnodejs:20 security update
- Red Hat Enterprise Linux AppStream (v. 8) nodejs-1:20.12.2-2.module+el8.9.0+21743+0b3f1be2.aarch64::nodejs:20, nodejs-1:20.12.2-2.module+el8.9.0+21743+0b3f1be2.ppc64le::nodejs:20, nodejs-1:20.12.2-2.module+el8.9.0+21743+0b3f1be2.s390x::nodejs:20 +20
- RHSA-2024:2779 Released 2024-05-09 · Red Hat rating Importantnodejs:18 security update
- Red Hat Enterprise Linux AppStream (v. 9) nodejs-1:18.20.2-2.module+el9.4.0+21742+692df1ea.aarch64::nodejs:18, nodejs-1:18.20.2-2.module+el9.4.0+21742+692df1ea.ppc64le::nodejs:18, nodejs-1:18.20.2-2.module+el9.4.0+21742+692df1ea.s390x::nodejs:18 +20
- RHSA-2024:2693 Released 2024-05-07 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.7.1-2.el7jbcs, jbcs-httpd24-httpd-2.4.57-10.el7jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el7jbcs +17
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.7.1-2.el8jbcs, jbcs-httpd24-httpd-2.4.57-10.el8jbcs, jbcs-httpd24-httpd-devel-2.4.57-10.el8jbcs +17
- RHSA-2024:2694 Released 2024-05-07 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.57 SP4 security update
- Red Hat JBoss Core Services
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder EUS (v.8.8) | Fixed | RHSA-2024:3701 |
| Red Hat CodeReady Linux Builder EUS (v.9.2) | Fixed | RHSA-2024:3665 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:2778, RHSA-2024:2780 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2779, RHSA-2024:2853, RHSA-2024:2910 |
| Red Hat Enterprise Linux AppStream E4S (v.9.0) | Fixed | RHSA-2024:4721 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:4824 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2024:2937, RHSA-2024:3544 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:4252 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2024:3501 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2024:4576 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2024:4732 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2024:3763 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.4) | Fixed | RHSA-2024:4732 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2024:3763 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2024:3875 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:3701 |
| Red Hat Enterprise Linux BaseOS EUS (v.9.2) | Fixed | RHSA-2024:3665 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.4) | Fixed | RHSA-2024:4732 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2024:3763 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:4252 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:3501 |
| Red Hat JBoss Core Services | Fixed | RHSA-2024:2694 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2024:2693 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2024:2693 |
Not affected: 1 product
- Red Hat Enterprise Linux 10
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28182
- 2026-10-09 Fix available: RHSA-2024:2694 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
References
Patch 2
Advisory 5
- https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
- https://lists.fedoraproject.org/archives/list/[email protected]/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/
- http://www.openwall.com/lists/oss-security/2024/04/03/16
More Nghttp2 vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2023-18006 Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec CVSS 3.1HIGH 7.5
- TI-2018-15818 nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation… CVSS 3.1HIGH 7.5
- TI-2015-07121 The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified… CVSS 3.0CRITICAL 10.0
- TI-2020-08954 Denial of service in nghttp2 CVSS 3.1HIGH 7.5
- TI-2026-21585 nghttp2 Denial of service: Assertion failure due to the missing state validation CVSS 3.1HIGH 7.5
Sources
- CVE-2024-28182 · CVE Program
- CVE-2024-28182 · NVD
- FIRST EPSS
- CVE-2024-28182 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences