Nghttp2
8 CVEs across 2 Nghttp2 products. Browse Nghttp2 vulnerabilities, severities, and proof-of-concept exploits.
Nghttp2 products with known CVEs
Nghttp2 CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-58055 | Medium | 5.4 | 2026-06-28 | nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend… |
CVE-2026-40170 | High | 7.5 | 2026-04-16 | ngtcp2 is a C implementation of the IETF QUIC protocol. In versions prior to 1.22.1, ngtcp2_qlog_parameters_set_transport_params() serializes peer transport pa… |
CVE-2026-27135 | High | 7.5 | 2026-03-18 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data wh… |
CVE-2024-28182 | Medium | 5.3 | 2024-04-04 | nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-35945 | High | 7.5 | 2023-07-13 | Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_S… |
CVE-2020-11080 | Low | 3.7 | 2020-06-03 | In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious cli… |
CVE-2016-1544 | Low | 3.3 | 2020-02-06 | nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion). |
CVE-2018-1000168 | High | 7.5 | 2018-05-08 | nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segment… |
CVE-2015-8659 | Critical | 10.0 | 2016-01-12 | The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug. |