CVE catalog

CVE-2018-1000168

nghttp2: CVE-2018-1000168

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
10.58% · Oct 27, 2026

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannghttp2sid1.70.0-1fixed
Debiannghttp2forky1.70.0-1fixed
Debiannghttp2trixie1.64.0-1.1+deb13u1fixed
Debiannghttp2trixie-security1.64.0-1.1+deb13u1fixed
Debiannghttp2bookworm1.52.0-1+deb12u3fixed
Debiannghttp2bookworm-security1.52.0-1+deb12u3fixed
Alpinenodejs3.108.11.3-r0fixed
Alpinenodejs3.118.11.3-r0fixed
Alpinenodejs3.128.11.3-r0fixed
Alpinenodejs3.138.11.3-r0fixed
Alpinenodejs3.148.11.3-r0fixed
Alpinenodejs3.158.11.3-r0fixed
Alpinenodejs3.168.11.3-r0fixed
Alpinenodejs3.178.11.3-r0fixed
Alpinenodejs3.188.11.3-r0fixed
Alpinenodejs3.198.11.3-r0fixed
Alpinenodejs3.208.11.3-r0fixed
Alpinenodejs3.218.11.3-r0fixed
Alpinenodejs3.228.11.3-r0fixed
Alpinenodejs3.238.11.3-r0fixed
Alpinenodejs3.248.11.3-r0fixed
Alpinenodejs3.88.11.3-r0fixed
Alpinenodejs3.98.11.3-r0fixed
Ubuntunghttp218.041.25.0-1vulnerable
Ubuntunghttp218.041.27.0-1vulnerable
Ubuntunghttp218.041.28.0-1vulnerable
Ubuntunghttp218.041.29.0-1vulnerable
Ubuntunghttp218.041.29.0-1build1vulnerable
Ubuntunghttp218.041.30.0-1vulnerable
Ubuntunghttp218.041.30.0-1ubuntu1fixed
Susenodejs8linux enterprise module for web and scripting 158.11.3-3.5.1fixed
Opensusenghttp2tumbleweed1.43.0-1.6fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannghttp2sourcesid1.31.1-1lowNot reported[895566]
Debiannghttp2sourceforky1.31.1-1lowNot reported[895566]
Debiannghttp2sourcetrixie1.31.1-1lowNot reported[895566]
Debiannghttp2sourcebookworm1.31.1-1lowNot reported[895566]
Alpinenodejsapk3.108.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.118.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.128.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.138.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.148.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.158.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.168.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.178.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.188.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.198.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.208.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.218.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.228.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.238.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.248.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.88.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Alpinenodejsapk3.98.11.3-r0Not reportedALPINE-CVE-2018-1000168Not reported
Ubuntunghttp2deb18.041.30.0-1ubuntu1Not reportedUBUNTU-CVE-2018-1000168Not reported
Susenodejs8rpmlinux enterprise module for web and scripting 158.11.3-3.5.1Not reportedSUSE-SU-2018:1918-1Not reported
Opensusenghttp2rpmtumbleweed1.43.0-1.6Not reportedOPENSUSE-SU-2024:11091-1Not reported

[Debian bug #895566]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libnghttp2-14]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.52.0-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

  • [libnghttp2-dev]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.52.0-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

  • [libnghttp2-doc]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.52.0-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · all · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · all · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

  • [nghttp2]Unknown
    Details (4)

    • 1.52.0-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · all · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · all · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · all · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

  • [nghttp2-client]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.52.0-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

  • [nghttp2-proxy]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.52.0-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

  • [nghttp2-server]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.52.0-1+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · amd64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

    • 1.52.0-1+deb12u3 · arm64 · bookworm-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · bookworm; dsa · nghttp2 · debian · 12

[Debian 13 (Trixie)]

  • [libnghttp2-14]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.64.0-1.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

  • [libnghttp2-dev]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.64.0-1.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

  • [libnghttp2-doc]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.64.0-1.1+deb13u1 · all · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · all · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

  • [nghttp2]Unknown
    Details (4)

    • 1.64.0-1.1+deb13u1 · all · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · all · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · all · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

  • [nghttp2-client]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.64.0-1.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

  • [nghttp2-proxy]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.64.0-1.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

  • [nghttp2-server]Unknown

    Source package: [nghttp2]

    Details (4)

    • 1.64.0-1.1+deb13u1 · amd64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

    • 1.64.0-1.1+deb13u1 · arm64 · trixie-security

      Fixed · Fixed: 1.31.1-1

      dsa · nghttp2 · debian · 13

[openSUSE Tumbleweed]

  • [libnghttp2-14]Unknown

    Source package: [nghttp2]

    Details (1)

    • 1.70.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.43.0-1.6

      Version impact unknown

      dsa · nghttp2 · opensuse · tumbleweed

  • [libnghttp2-14-32bit]Unknown

    Source package: [nghttp2]

    Details (1)

    • 1.70.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.43.0-1.6

      Version impact unknown

      dsa · nghttp2 · opensuse · tumbleweed

  • [libnghttp2-devel]Unknown

    Source package: [nghttp2]

    Details (1)

    • 1.70.0-1.1 · x86_64 · tumbleweed

      Unknown · Fixed: 1.43.0-1.6

      Version impact unknown

      dsa · nghttp2 · opensuse · tumbleweed

  • [nghttp2]Unknown

    Source package: [nghttp2]

    Details (1)

    • 1.70.0-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 1.43.0-1.6

      dsa · nghttp2 · opensuse · tumbleweed

  • [nghttp2-doc]Unknown

    Source package: [nghttp2]

    Details (1)

    • 1.70.0-1.1 · noarch · tumbleweed

      Unknown · Fixed: 1.43.0-1.6

      Version impact unknown

      dsa · nghttp2 · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]