CVE-2024-28182

MediumCVSS 5.3/10Last modified Oct 15, 2026

Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Apr 4, 2024
Last modified: Oct 15, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-281835.7ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulne CVE-2024-281847.4WeasyPrint helps web developers to create PDF documents. Since version 61.0, there's a vulnerability which allows attaching content of arbit CVE-2024-2818510.0Judge0 is an open-source online code execution system. The application does not account for symlinks placed inside the sandbox directory, wh CVE-2024-281867.1FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, w CVE-2024-281877.2SOY CMS is an open source CMS (content management system) that allows you to build blogs and online shops. SOY CMS versions prior to 3.14.2 CVE-2024-281885.3Jupyter Scheduler is collection of extensions for programming jobs to run now or run on a schedule. The list of conda environments of `jupyt CVE-2024-2818910.0Judge0 is an open-source online code execution system. The application uses the UNIX chown command on an untrusted file within the sandbox. CVE-2024-28196.5Incorrect Default Permissions, Improper Preservation of Permissions vulnerability in Hitachi Ops Center Common Services allows File Manipula CVE-2024-281905.4Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malic CVE-2024-281915.4Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inje CVE-2024-281925.3your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 is vulnerable to NoSQL injection in the p CVE-2024-281936.5your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version <1.8.0 allows users to create a public token in