CVE-2024-28182

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

• CWE-770

• http://www.openwall.com/lists/oss-security/2024/04/03/16Mailing List, Third Party Advisory
• https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0Patch
• https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9Patch
• https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57qVendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00026.htmlMailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2024/04/03/16Mailing List, Third Party Advisory
• https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0Patch
• https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9Patch
• https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57qVendor Advisory
• https://lists.debian.org/debian-lts-announce/2024/04/msg00026.htmlMailing List
• https://lists.debian.org/debian-lts-announce/2024/09/msg00041.htmlMailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AGOME6ZXJG7664IPQNVE3DL67E3YP3HY/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J6ZMXUGB66VAXDW5J6QSTHM5ET25FGSA/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PXJO2EASHM2OQQLGVDY5ZSO7UVDVHTDK/Mailing List, Third Party Advisory
• https://www.kb.cert.org/vuls/id/421644

Published

Apr 4, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28175Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
• CVE-2024-28176jose is JavaScript module for JSON Object Signing and Encryp…5.9
• CVE-2024-28179Jupyter Server Proxy allows users to run arbitrary external …9.8
• CVE-2024-2818An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2024-28180Package jose aims to provide an implementation of the Javasc…4.3
• CVE-2024-28181 turbo_boost-commands is a set of commands to help you build…8.1
• CVE-2024-28183ESP-IDF is the development framework for Espressif SoCs supp…5.7
• CVE-2024-28184WeasyPrint helps web developers to create PDF documents. Sin…7.4
• CVE-2024-28185Judge0 is an open-source online code execution system. The a…10
• CVE-2024-28186FreeScout is an open source help desk and shared inbox built…7.1
• CVE-2024-28187SOY CMS is an open source CMS (content management system) th…7.2
• CVE-2024-28188Jupyter Scheduler is collection of extensions for programmin…5.3