First published: Wed Nov 22 2023(Updated: )
It was discovered that nghttp2 incorrectly handled request cancellation. A remote attacker could possibly use this issue to cause nghttp2 to consume resources, leading to a denial of service.
Affected Software | Affected Version | How to fix |
---|---|---|
All of | ||
ubuntu/libnghttp2-14 | <1.55.1-1ubuntu0.1 | 1.55.1-1ubuntu0.1 |
Ubuntu Ubuntu | =23.10 | |
All of | ||
ubuntu/nghttp2 | <1.55.1-1ubuntu0.1 | 1.55.1-1ubuntu0.1 |
Ubuntu Ubuntu | =23.10 | |
All of | ||
ubuntu/nghttp2-client | <1.55.1-1ubuntu0.1 | 1.55.1-1ubuntu0.1 |
Ubuntu Ubuntu | =23.10 | |
All of | ||
ubuntu/nghttp2-proxy | <1.55.1-1ubuntu0.1 | 1.55.1-1ubuntu0.1 |
Ubuntu Ubuntu | =23.10 | |
All of | ||
ubuntu/nghttp2-server | <1.55.1-1ubuntu0.1 | 1.55.1-1ubuntu0.1 |
Ubuntu Ubuntu | =23.10 | |
All of | ||
ubuntu/libnghttp2-14 | <1.52.0-1ubuntu0.1 | 1.52.0-1ubuntu0.1 |
Ubuntu Ubuntu | =23.04 | |
All of | ||
ubuntu/nghttp2 | <1.52.0-1ubuntu0.1 | 1.52.0-1ubuntu0.1 |
Ubuntu Ubuntu | =23.04 | |
All of | ||
ubuntu/nghttp2-client | <1.52.0-1ubuntu0.1 | 1.52.0-1ubuntu0.1 |
Ubuntu Ubuntu | =23.04 | |
All of | ||
ubuntu/nghttp2-proxy | <1.52.0-1ubuntu0.1 | 1.52.0-1ubuntu0.1 |
Ubuntu Ubuntu | =23.04 | |
All of | ||
ubuntu/nghttp2-server | <1.52.0-1ubuntu0.1 | 1.52.0-1ubuntu0.1 |
Ubuntu Ubuntu | =23.04 | |
All of | ||
ubuntu/libnghttp2-14 | <1.43.0-1ubuntu0.1 | 1.43.0-1ubuntu0.1 |
Ubuntu Ubuntu | =22.04 | |
All of | ||
ubuntu/nghttp2 | <1.43.0-1ubuntu0.1 | 1.43.0-1ubuntu0.1 |
Ubuntu Ubuntu | =22.04 | |
All of | ||
ubuntu/nghttp2-client | <1.43.0-1ubuntu0.1 | 1.43.0-1ubuntu0.1 |
Ubuntu Ubuntu | =22.04 | |
All of | ||
ubuntu/nghttp2-proxy | <1.43.0-1ubuntu0.1 | 1.43.0-1ubuntu0.1 |
Ubuntu Ubuntu | =22.04 | |
All of | ||
ubuntu/nghttp2-server | <1.43.0-1ubuntu0.1 | 1.43.0-1ubuntu0.1 |
Ubuntu Ubuntu | =22.04 | |
All of | ||
ubuntu/libnghttp2-14 | <1.40.0-1ubuntu0.2 | 1.40.0-1ubuntu0.2 |
Ubuntu Ubuntu | =20.04 | |
All of | ||
ubuntu/nghttp2 | <1.40.0-1ubuntu0.2 | 1.40.0-1ubuntu0.2 |
Ubuntu Ubuntu | =20.04 | |
All of | ||
ubuntu/nghttp2-client | <1.40.0-1ubuntu0.2 | 1.40.0-1ubuntu0.2 |
Ubuntu Ubuntu | =20.04 | |
All of | ||
ubuntu/nghttp2-proxy | <1.40.0-1ubuntu0.2 | 1.40.0-1ubuntu0.2 |
Ubuntu Ubuntu | =20.04 | |
All of | ||
ubuntu/nghttp2-server | <1.40.0-1ubuntu0.2 | 1.40.0-1ubuntu0.2 |
Ubuntu Ubuntu | =20.04 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for the nghttp2 vulnerability is USN-6505-1.
The nghttp2 vulnerability allows a remote attacker to cause a denial of service by exploiting an issue with request cancellation.
The nghttp2 vulnerability affects the following software: libnghttp2-14, nghttp2, nghttp2-client, nghttp2-proxy, and nghttp2-server.
The severity of the nghttp2 vulnerability has not been provided.
To fix the nghttp2 vulnerability, update the affected software to version 1.55.1-1ubuntu0.1.