USN-6754-1

Dashboard / Vulnerabilities / USN-6754-1

USN-6754-1

Summary: nghttp2 vulnerabilities

Details: It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-9511, CVE-2019-9513) It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2023-44487) It was discovered that nghttp2 could be made to process an unlimited number of HTTP/2 CONTINUATION frames. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service. (CVE-2024-28182)

References: https://ubuntu.com/security/notices/USN-6754-1, https://ubuntu.com/security/CVE-2019-9511, https://ubuntu.com/security/CVE-2019-9513, https://ubuntu.com/security/CVE-2023-44487, https://ubuntu.com/security/CVE-2024-28182