nghttp2 vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20241
3. 20262

Newest CVEs

• CVE-2026-58055

  nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

  nghttp2 · nghttp2

  Medium6.3
• CVE-2026-27135

  nghttp2 Denial of service: Assertion failure due to the missing state validation

  nghttp2 · nghttp2

  High7.5
• CVE-2024-28182

  Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

  nghttp2 · nghttp2

  Medium5.3
• CVE-2020-11080

  Denial of service in nghttp2

  nghttp2 · nghttp2

  Low3.7
• CVE-2016-1544

  nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).

  nghttp2 · nghttp2

  Low3.3