Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

AlmaLinux libnghttp2 can cause service slowdown

published 2 years ago

Summary

The libnghttp2 library in AlmaLinux, which handles HTTP/2 traffic, can be forced to use excessive processing power when it receives a specially crafted continuation frame, potentially making the server stop responding. This affects any application that relies on the library, such as web servers or client tools. Install the latest libnghttp2 and libnghttp2-devel packages from AlmaLinux to protect against this.

What to do

Update almalinux libnghttp2 to version 1.33.0-6.el8_10.1.
Update almalinux libnghttp2-devel to version 1.33.0-6.el8_10.1.
Update almalinux nghttp2 to version 1.33.0-6.el8_10.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
AlmaLinux:8	almalinux	libnghttp2	< 1.33.0-6.el8_10.1 Fix: upgrade to 1.33.0-6.el8_10.1
AlmaLinux:8	almalinux	libnghttp2-devel	< 1.33.0-6.el8_10.1 Fix: upgrade to 1.33.0-6.el8_10.1
AlmaLinux:8	almalinux	nghttp2	< 1.33.0-6.el8_10.1 Fix: upgrade to 1.33.0-6.el8_10.1

Original advisory text

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

* nghttp2: CONTINUATION frames DoS (CVE-2024-28182)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

https://access.redhat.com/errata/RHSA-2024:4252 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2024-28182 Third Party Advisory
https://bugzilla.redhat.com/2268639 Third Party Advisory
https://errata.almalinux.org/8/ALSA-2024-4252.html Vendor Advisory

Timeline

Published2 Jul 2024

Updated29 Oct 2026

First seen29 Oct 2026

Sources

ALSA-2024:4252 · OSV

Track software like this

Free during beta