{"id":"CVE-2016-1544","aliases":["DEBIAN-CVE-2016-1544","EUVD-2016-2639","GHSA-32wx-5655-89rw","SUSE-SU-2021:0932-1","UBUNTU-CVE-2016-1544","openSUSE-SU-2024:10164-1"],"status":"published","title":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","severity":{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00886,"percentile":0.59483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2020-02-06T14:20:29Z","modified":"2026-10-20T10:49:30Z","fixes":[{"ecosystem":"Debian:12","package":"nghttp2","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nghttp2","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nghttp2","fixed_in":["1.7.1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","fixed_in":["1.17.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.0-1.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"nghttp2","product":"nghttp2"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1308461","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/nghttp2/nghttp2/releases/tag/v1.7.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://github.com/nghttp2/nghttp2/compare/v1.7.0...v1.7.1","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201612-13","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177666.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177308.html","tags":["x_refsource_CONFIRM","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1544"},{"url":"https://github.com/advisories/GHSA-32wx-5655-89rw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-1544","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210932-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1082318","tags":["report"]},{"url":"https://bugzilla.suse.com/1088639","tags":["report"]},{"url":"https://bugzilla.suse.com/1112438","tags":["report"]},{"url":"https://bugzilla.suse.com/1125689","tags":["report"]},{"url":"https://bugzilla.suse.com/1134616","tags":["report"]},{"url":"https://bugzilla.suse.com/1146182","tags":["report"]},{"url":"https://bugzilla.suse.com/1146184","tags":["report"]},{"url":"https://bugzilla.suse.com/1181358","tags":["report"]},{"url":"https://bugzilla.suse.com/962914","tags":["report"]},{"url":"https://bugzilla.suse.com/964140","tags":["report"]},{"url":"https://bugzilla.suse.com/966514","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11080","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-1544","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-1544","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2016-1544","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"published","published":"2020-02-06T14:20:29Z","modified":"2024-08-05T23:02:11.949Z","updated_at":"2026-11-02T14:33:36.175943Z"}],"euvd":[{"id":"EUVD-2016-2639","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"published","published":"2020-02-06T14:20:29Z","modified":"2024-08-05T23:02:11Z","updated_at":"2026-11-03T02:22:56.986033Z"}],"ghsa":[{"id":"GHSA-32wx-5655-89rw","title":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"published","published":"2022-05-24T17:08:07Z","modified":"2023-01-29T05:01:15Z","updated_at":"2026-11-02T14:44:46.468507Z"}],"nvd":[{"id":"CVE-2016-1544","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"published","published":"2020-02-06T15:15:11.17Z","modified":"2026-06-17T00:42:08.173Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:03:40.524348Z"}],"osv":[{"id":"CVE-2016-1544","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"published","published":"2020-02-06T15:15:11.17Z","modified":"2026-10-20T10:49:30.856952029Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-1544","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"published","published":"2020-02-06T15:15:11.17Z","modified":"2026-09-22T07:01:15.016247782Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"UBUNTU-CVE-2016-1544","description":"nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).","status":"withdrawn","published":"2020-02-06T15:15:00Z","modified":"2025-07-17T16:52:28Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T15:54:11.492576Z"},{"id":"openSUSE-SU-2024:10164-1","title":"libnghttp2-14-1.17.0-1.1 on GA media","description":"These are all security issues fixed in the libnghttp2-14-1.17.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:57:53.295877Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2021:0932-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358).\n- CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184).\n- CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182).\n- CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639).\n- CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514).\n\nBug fixes and enhancements:\n\n- Packages must not mark license files as %doc (bsc#1082318)\n- Typo in description of libnghttp2_asio1 (bsc#962914)\n- Fixed mistake in spec file (bsc#1125689)\n- Fixed build issue with boost 1.70.0 (bsc#1134616)\n- Fixed build issue with GCC 6 (bsc#964140)\n- Feature: Add W\u0026S module (FATE#326776, bsc#1112438)\n  ","status":"published","published":"2021-03-24T11:13:09Z","modified":"2026-02-04T03:24:08.572165Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}