CVE-2018-16843: nginx HTTP/2 module memory exhaustion denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityHigh CVSS (7.5) availability impact with no authentication required and very high EPSS, though exploitation is constrained to non-default HTTP/2-enabled builds.

What it is

nginx before 1.15.6 and 1.14.1 has a flaw in its HTTP/2 implementation that allows excessive memory consumption. It only affects builds compiled with the ngx_http_v2_module (not default) where the http2 option is set on a listen directive, so exposure is limited to HTTP/2-enabled deployments.

Impact

An unauthenticated remote attacker can drive memory consumption high enough to degrade or exhaust server resources, causing denial of service for the affected nginx instance.

Attack surface

Reachable over the network via HTTP/2 requests to a listener configured with the http2 option; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is recorded in the references, but EPSS is high at roughly 0.47 probability (98.8th percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade nginx to 1.15.6 or 1.14.1 or later, or apply the vendor/distribution patch (Red Hat, Ubuntu, Debian, openSUSE advisories are referenced).
• If HTTP/2 is not required, remove the http2 option from listen directives or rebuild without ngx_http_v2_module to eliminate exposure.
• Where patching is delayed, cap and monitor worker memory and set process limits so a single worker cannot exhaust host memory.
• Review reverse proxy and load balancer configurations to confirm whether HTTP/2 termination occurs at nginx or upstream.

Detection

• Monitor nginx worker process memory growth and OOM-killer events for abnormal spikes on HTTP/2 listeners.
• Alert on high volumes of HTTP/2 connections or streams from single sources against nginx endpoints.
• Track nginx version inventory to identify hosts still running builds compiled with ngx_http_v2_module below 1.15.6/1.14.1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.