Skip to content
Nghttp2 vulnerabilities
Newest
-
nghttp2
nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length
CVE-2026-58055
Fix available
6.3 Medium
-
nghttp2, red hat jboss core services for rhel 8, jboss core services on rhel 7 +35 more +37 more
nghttp2 Denial of service: Assertion failure due to the missing state validation
CVE-2026-27135
Fix available
7.5 High
-
nghttp2, debian linux, fedoraproject fedora +4 more +6 more
Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
CVE-2024-28182
Fix available
EPSS 82.0%
5.3 Medium
-
envoyproxy envoy, nghttp2, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more
Envoy vulnerable to HTTP/2 memory leak in nghttp2 codec
CVE-2023-35945
Fix available
7.5 High
-
eclipse jetty, ietf http, http/2 +166 more +168 more
Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations
CVE-2023-44487
In KEVPublic exploitFix available
EPSS 100.0%
7.5 High
-
nghttp2, debian linux, fedoraproject fedora +7 more +9 more
Denial of service in nghttp2
CVE-2020-11080
Fix available
3.7 Low
-
nghttp2, fedoraproject fedora +1 more
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
CVE-2016-1544
Fix available
3.3 Low
-
nghttp2, debian linux, nodejs node.js +2 more
nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20...
CVE-2018-1000168
Fix available
EPSS 10.6%
7.5 High
-
nghttp2, apple iphone os, mac os x +2 more +4 more
The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via...
CVE-2015-8659
Fix available
10.0 Critical