Nghttp2 - vulnerabilities (CVEs)
9 CVEs in 2 products, 0 in the last 30 days, newest from 2026-06-28.
Products
Newest CVEs of Nghttp2
- CVE-2026-58055 - CVSS 6.3 (medium), 2026-06-28: nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive…
- CVE-2026-27135 - CVSS 7.5 (high), 2026-03-18: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data…
- CVE-2024-28182 - CVSS 5.3 (medium), 2024-04-04: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number…
- CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
- CVE-2023-35945 - CVSS 7.5 (high), 2023-07-13: Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving…
- CVE-2020-11080 - CVSS 7.5 (high), 2020-06-03: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious…
- CVE-2016-1544 - CVSS 3.3 (low), 2020-02-06: nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
- CVE-2018-1000168 - CVSS 7.5 (high), 2018-05-08: nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in…
- CVE-2015-8659 - CVSS 10 (critical), 2016-01-12: The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
