CVEvulnerability

CVE-2018-1000168

7.5 HIGH Published 2018-05-08 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-05-08
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20, CWE-476

Description

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

Affected configurations

• nghttp2 nghttp2 (>= 1.10.0 <= 1.31.0) • nodejs node.js (>= 6.0.0 <= 6.8.1) • nodejs node.js (>= 8.4.0 <= 8.17.0) • nodejs node.js (>= 9.0.0 <= 9.11.2) • nodejs node.js (>= 10.0.0 < 10.4.1) • debian debian linux 9.0

Related

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-476 NULL Pointer Dereference weakness

References