Nghttp2 reports :

Out of memory in nghttpd, nghttp, and libnghttp2_asio applications due to unlimited incoming HTTP header fields.

nghttpd, nghttp, and libnghttp2_asio applications do not limit the memory usage for the incoming HTTP header field. If peer sends specially crafted HTTP/2 HEADERS frames and CONTINUATION frames, they will crash with out of memory error.

Note that libnghttp2 itself is not affected by this vulnerability.

CVE-2016-1544: Out of memory in nghttpd, nghttp, and libnghttp2_asio applications due to unlimited incoming HTTP header fields:
https://github.com/tatsuhiro-t/nghttp2/releases/tag/v1.7.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for nghttp2 fixes the following issues :

Security issues fixed :

CVE-2020-11080: HTTP/2 Large Settings Frame DoS (bsc#1181358).

CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service (bsc#1146184).

CVE-2019-9511: Fixed HTTP/2 implementations that are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service (bsc#1146182).

CVE-2018-1000168: Fixed ALTSVC frame client side denial of service (bsc#1088639).

CVE-2016-1544: Fixed out of memory due to unlimited incoming HTTP header fields (bsc#966514).

Bug fixes and enhancements :

Packages must not mark license files as %doc (bsc#1082318)

Typo in description of libnghttp2_asio1 (bsc#962914)

Fixed mistake in spec file (bsc#1125689)

Fixed build issue with boost 1.70.0 (bsc#1134616)

Fixed build issue with GCC 6 (bsc#964140)

Feature: Add W&S module (FATE#326776, bsc#1112438)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201612-13 (nghttp2: Denial of Service)

    Nghttpd, nghttp, and libnghttp2_asio applications do not limit the       memory usage for the incoming HTTP header field. If a peer sends a       specially crafted HTTP/2 HEADERS frame and CONTINUATION frame, they will       crash with an out of memory error.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the cmake package has been released.

This update for nghttp2 fixes the following vulnerabilities :

  - CVE-2016-1544: A malicious remote attacker could have     caused an Out of memory condition due to unlimited     incoming HTTP header fields (boo#966514)

ID	Name	Product	Family	Published	Updated	Severity
88729	FreeBSD : nghttp2 -- Out of memory in nghttpd, nghttp, and libnghttp2_asio (07718e2b-d29d-11e5-a95f-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	2/15/2016	1/4/2021	low
89593	Fedora 23 : nghttp2-1.7.1-1.fc23 (2016-ac861a840e)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
148164	SUSE SLES12 Security Update : nghttp2 (SUSE-SU-2021:0932-1) (Data Dribble) (Resource Loop)	Nessus	SuSE Local Security Checks	3/26/2021	1/8/2024	high
95528	GLSA-201612-13 : nghttp2: Denial of Service	Nessus	Gentoo Local Security Checks	12/5/2016	1/11/2021	low
204588	Photon OS 4.0: Cmake PHSA-2023-4.0-0420	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
89812	openSUSE Security Update : nghttp2 (openSUSE-2016-314)	Nessus	SuSE Local Security Checks	3/10/2016	1/19/2021	low
89521	Fedora 22 : nghttp2-1.7.1-1.fc22 (2016-3d9efe44d8)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high

Detections

Analytics

Plugins Search

low

high

high

low

critical

low

high