ZeroDay Findings
Sign inSign up

Findings

CVE-2024-28182

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

Published Apr 4, 2024 · updated Oct 15, 2026 · nghttp2 nghttp2

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 4, 2024 · NIST NVD

    Detected

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it a

  2. Oct 15, 2026 · NIST NVD

    Updated

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it a

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe fedoraproject/fedora38
  • cpe fedoraproject/fedora39
  • cpe fedoraproject/fedora40
  • cpe nghttp2/nghttp2version unspecified

Sources

  • CVE.orgVulnerability recordCVE-2024-28182

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2024-28182

    30-day exploitation probability 85.0%

    first.org
  • NIST NVDVulnerability recordCVE-2024-28182

    nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usag

    nvd.nist.gov

References