CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
Vulnerability summary
CVE-2024-28182 is a medium (CVSS 5.3) vulnerability in debian debian_linux. EPSS estimates a 84.96% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 3Timeline
- 04-04-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
84.96%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
No change 0.00 pp
From 84.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse23 products
- nghttp2&distro=SUSE Enterprise Storage 7.1< 1.40.0-150200.17.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 1.40.0-150200.17.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 1.40.0-150200.17.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.40.0-150200.17.1
- nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.40.0-150200.17.1
Redhat6 products
- libnghttp2< 0:1.43.0-5.el9_4.3 | < 0:1.43.0-5.el9_2.3 | < 0:1.33.0-5.el8_8.1 | < 0:1.33.0-4.el8_6.2 | < 0:1.43.0-5.el9_0.3 | < 0:1.33.0-6.el8_10.1 | < 0:1.33.0-3.el8_2.3 | < 0:1.33.0-4.el8_4.2
- libnghttp2-debuginfo< 0:1.43.0-5.el9_4.3 | < 0:1.43.0-5.el9_2.3 | < 0:1.33.0-5.el8_8.1 | < 0:1.33.0-4.el8_6.2 | < 0:1.43.0-5.el9_0.3 | < 0:1.33.0-6.el8_10.1 | < 0:1.33.0-3.el8_2.3 | < 0:1.33.0-4.el8_4.2
- libnghttp2-devel< 0:1.43.0-5.el9_4.3 | < 0:1.43.0-5.el9_2.3 | < 0:1.33.0-5.el8_8.1 | < 0:1.33.0-6.el8_10.1
- nghttp2< 0:1.43.0-5.el9_4.3 | < 0:1.43.0-5.el9_2.3 | < 0:1.33.0-5.el8_8.1 | < 0:1.33.0-4.el8_6.2 | < 0:1.43.0-5.el9_0.3 | < 0:1.33.0-6.el8_10.1 | < 0:1.33.0-3.el8_2.3 | < 0:1.33.0-4.el8_4.2
- nghttp2-debuginfo< 0:1.43.0-5.el9_4.3 | < 0:1.43.0-5.el9_2.3 | < 0:1.33.0-5.el8_8.1 | < 0:1.33.0-4.el8_6.2 | < 0:1.43.0-5.el9_0.3 | < 0:1.33.0-6.el8_10.1 | < 0:1.33.0-3.el8_2.3 | < 0:1.33.0-4.el8_4.2
Opensuse5 products
- nghttp2-python&distro=openSUSE Leap 15.5< 1.40.0-150200.17.1
- nghttp2&distro=openSUSE Leap 15.5< 1.40.0-150200.17.1
- nghttp2&distro=openSUSE Leap Micro 5.3< 1.40.0-150200.17.1
- nghttp2&distro=openSUSE Leap Micro 5.4< 1.40.0-150200.17.1
- nghttp2&distro=openSUSE Tumbleweed< 1.61.0-1.1
Debian2 products
- nghttp2< 1.36.0-2+deb10u3 | < 1.43.0-1+deb11u2 | < 1.52.0-1+deb12u2 | < 1.61.0-1
- debian_linuxEOL10.0 | 11.0
Chainguard1 product
- nghttp2< 1.61.0-r0
Fedoraproject1 product
- fedoraEOL38 | 39 | 40
Mageia1 product
- nghttp2< 1.61.0-1.mga9
Nghttp21 product
- nghttp2< 1.61.0
Ubuntu1 product
- nghttp2< 1.7.1-1ubuntu0.1~esm2 | < 1.30.0-1ubuntu1+esm2 | < 1.40.0-1ubuntu0.3 | < 1.43.0-1ubuntu0.2 | < 1.59.0-1ubuntu0.1
Wolfi1 product
- nghttp2< 1.61.0-r0
10 vendors · 42 products
References
47 links- github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57qX Refsource CONFIRMAdvisoryARTICLEREPORTVendor Advisory
