Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Debian 10: DLA-3804-1 critical: nghttp2 Denial of Service threat

debian lts
Calendar Grey April 30, 2024
Dist Debian Esm H88
Important Security Patch for nghttp2 on Debian LTS tackling Denial of Service vulnerability caused by high CPU load.
Bartek Nowotarskis discovered that nghttp2, a set of programs implementing the HTTP/2, keeps reading CONTINUATION frames even after a stream is reset to keep HPACK context in sync
Topics%20covered

Topics Covered

security advisory denial of service security update critical software update debian Debian critical threat Denial of Service nghttp2 CPU usage cpu usage

Summary

The issue is mitigated by limiting the number of CONTINUATION frames it
can accept after a HEADERS frame. The limit is configurable and
defaults to 8.

For Debian 10 buster, this problem has been fixed in version
1.36.0-2+deb10u3.

We recommend that you upgrade your nghttp2 packages.

For the detailed security status of nghttp2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/nghttp2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: nghttp2
Version: 1.36.0-2+deb10u3
CVE ID: CVE-2024-28182
Debian Bug: 1068415

Topics%20covered

Topics Covered

security advisory denial of service security update critical software update debian Debian critical threat Denial of Service nghttp2 CPU usage cpu usage

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here