Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-28182

Medium

The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.

Published Apr 4, 2024 · Updated Oct 16, 2026 · Also known as DEBIAN-CVE-2024-28182, DLA-3804-1, DLA-3898-1, GHSA-x6x3-gv8h-m57q, JLSEC-2026-4, ROOT-OS-ALPINE-317-CVE-2024-28182, ROOT-OS-ALPINE-318-CVE-2024-28182, ROOT-OS-ALPINE-319-CVE-2024-28182, SUSE-SU-2024:1156-1, SUSE-SU-2024:1167-1, SUSE-SU-2024:1167-2, UBUNTU-CVE-2024-28182, USN-6754-2

Key Facts

Patch immediately
  • CVE-2024-28182 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Nghttp2, Debian Linux, Fedora (Fedoraproject) and 22 more products.
  • It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
  • EPSS estimates a 85% probability of exploitation in the next 30 days.
  • Fixed versions are available, including cmake 3.21.4-14, cmake 3.29.6-1, fluent-bit 3.0.6-1.
  • Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v3.1

5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS (30-day exploit likelihood)

85%

Higher than 99.7% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2024-28182 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

Affected Products

272 affected entries in total
ProductAffected versionsFixed in
Nghttp2Nghttp2>= < 1.61.01.61.0
Debian LinuxDebian10.0, 11.0n/a
FedoraFedoraproject38, 39, 40n/a
rootio-nghttp2rootioSee advisory1.51.0-r20071
nghttp2_jlljuliaSee advisory1.61.0+0
20 more affected products in the full CVE brief

Patched Releases

cmake

3.21.4-14, 3.29.6-1

fluent-bit

3.0.6-1, 3.1.9-2

jbcs-httpd24-curl

0:8.7.1-2.el7jbcs, 0:8.7.1-2.el8jbcs

jbcs-httpd24-httpd

0:2.4.57-10.el7jbcs, 0:2.4.57-10.el8jbcs

jbcs-httpd24-mod_http2

0:1.15.19-37.el7jbcs, 0:1.15.19-37.el8jbcs

jbcs-httpd24-mod_jk

0:1.2.49-6.redhat_1.el7jbcs, 0:1.2.49-6.redhat_1.el8jbcs

jbcs-httpd24-mod_md

1:2.4.24-6.el7jbcs, 1:2.4.24-6.el8jbcs

jbcs-httpd24-mod_proxy_cluster

0:1.3.20-4.el7jbcs, 0:1.3.20-4.el8jbcs

jbcs-httpd24-mod_security

0:2.9.3-36.el7jbcs, 0:2.9.3-36.el8jbcs

jbcs-httpd24-nghttp2

0:1.43.0-13.el7jbcs, 0:1.43.0-13.el8jbcs

libnghttp2

1.33.0-1.1.9.amzn1, 1.33.0-6.el8_10.1, 1.41.0-1.amzn2.0.5, 1.43.0-5.el9_4.3, 1.59.0-3.amzn2023.0.1

libnghttp2_asio-devel

1.40.0-150200.17.1

libnghttp2_asio1

1.40.0-150200.17.1

libnghttp2_asio1-32bit

1.40.0-150200.17.1

libnghttp2-14

1.39.2-3.18.1, 1.40.0-150200.17.1, 1.52.0-5.1, 1.61.0-1.1

libnghttp2-14-32bit

1.39.2-3.18.1, 1.40.0-150200.17.1, 1.61.0-1.1

libnghttp2-devel

1.33.0-1.1.9.amzn1, 1.33.0-6.el8_10.1, 1.39.2-3.18.1, 1.40.0-150200.17.1, 1.41.0-1.amzn2.0.5, 1.43.0-5.el9_4.3, 1.59.0-3.amzn2023.0.1, 1.61.0-1.1

Nghttp2

0:1.33.0-5.el8_8.1, 0:1.43.0-5.el9_2.3, 1.30.0-1ubuntu1+esm2, 1.33.0-1.1.9.amzn1, 1.33.0-6.el8_10.1, 1.33.0-6.el8_10.1+sp999, 1.36.0-2+deb10u3, 1.39.2-3.18.1, 1.40.0-150200.17.1, 1.40.0-1ubuntu0.3, 1.41.0-1.amzn2.0.5, 1.43.0-1+deb11u2, 1.43.0-1ubuntu0.2, 1.43.0-5.el9_4.3, 1.51.0-r20071, 1.51.0-r20072, 1.51.0-r20073, 1.51.0-r20074, 1.51.0-r20075, 1.52.0-1+deb12u2, 1.57.0-2, 1.57.0-2.ph4, 1.57.0-2.ph5, 1.57.0-r00072, 1.58.0-r00072, 1.59.0-1ubuntu0.1, 1.59.0-3.amzn2023.0.1, 1.61.0-1, 1.61.0-1.1, 1.61.0-r0, 1.7.1-1ubuntu0.1~esm2, 1.61.0

nghttp2_jll

1.61.0+0

nghttp2-devel

1.57.0-2.ph4, 1.57.0-2.ph5

nghttp2-python

1.40.0-150200.17.1

nodejs

1:10.5.0-1.18.20.2.1.module_el8.9.0+3828+c9fa9644, 1:10.5.0-1.20.12.2.2.module_el9.4.0+100+71fc9528, 1:16.20.2-5.el9_2.3, 1:16.20.2-8.0.1.el9_4, 1:16.20.2-8.el9_4, 1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+1803+9ac8b495, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:18.20.2-2.module_el9.4.0+99+a01f7676, 1:20.12.2-2.module_el8.9.0+3827+11b91f3e, 1:20.12.2-2.module+el8.9.0+1804+2708cc21, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c, 1:8.19.4-1.16.20.2.8.el9_4, 20.14.0-1

nodejs-devel

1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c

nodejs-docs

1:16.20.2-8.0.1.el9_4, 1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c

nodejs-full-i18n

1:16.20.2-8.0.1.el9_4, 1:18.18.2-1.amzn2023.0.4, 1:18.20.2-1.module+el8.9.0+90319+0b1e7189, 1:18.20.2-1.module+el9.4.0+90321+c72a88c5, 1:20.12.2-2.module+el8.9.0+90318+7fb2e04b, 1:20.12.2-2.module+el9.4.0+90322+0b80090c

Timeline

  1. Publicly disclosed

    Apr 4, 2024

  2. Last updated

    Oct 16, 2026

Weakness Type

  • CWE-390 Detection of Error Condition Without Action
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

15 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-28182 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo