nghttp2 vulnerabilities (Alpine)

7 vulnerabilities.

• nghttp2 Alpine nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length CVE-2026-58055 Fix available 6.3 MediumJune 28, 2026
• nghttp2 Alpine nghttp2 Denial of service: Assertion failure due to the missing state validation CVE-2026-27135 Fix available 7.5 HighMarch 18, 2026
• nghttp2 Alpine Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec CVE-2023-35945 Fix available 7.5 HighJuly 13, 2023
• nghttp2 Alpine Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• nghttp2 Alpine Denial of service in nghttp2 CVE-2020-11080 Fix available 3.7 LowJune 3, 2020
• nghttp2 Alpine Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service CVE-2019-9513 Fix available EPSS 81.6% 7.5 HighAugust 13, 2019
• nghttp2 Alpine Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service CVE-2019-9511 Public exploitFix available EPSS 59.5% 7.5 HighAugust 13, 2019