CVE-2024-28182

MEDIUM

Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2024-28182 has a selected CVSS score of 5.3 (medium); EIP currently links 1 repository PoC.

Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 4, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

nghttp2

Browse nghttp2 / nghttp2

Default status: unknown

CVE ListBefore 1.61.0affected
< 1.61.0affected

Proofs of concept

1

Repository PoCs

GitHublockness-Ko/CVE-2024-27316Repository PoCby lockness-Ko18Not analyzed6 files

22.2 KiB · linked to 6 vulnerabilities

GitHub
PoC details

References

10