CVE-2024-28182: nghttp2 HTTP/2 CONTINUATION frame flood causes CPU exhaustion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityEPSS is very high (0.8496, 99.7th percentile) and the flaw is remotely reachable without authentication, though CVSS rates impact as only low availability loss.

What it is

nghttp2 before 1.61.0 keeps reading an unbounded number of HTTP/2 CONTINUATION frames after a stream is reset, in order to keep the HPACK context in sync. This allows excessive CPU consumption during HPACK decoding. The flaw is an allocation-without-limits issue (CWE-770) and there is no workaround other than upgrading.

Impact

An attacker can force the server to spend excessive CPU decoding HPACK streams, degrading or denying service to legitimate HTTP/2 clients. The CVSS vector shows only availability impact (A:L), with no confidentiality or integrity loss.

Attack surface

Reachable over the network via HTTP/2 traffic (AV:N) with no authentication (PR:N) and no user interaction (UI:N). Any endpoint that accepts HTTP/2 connections using an affected nghttp2 version is exposed.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.8496, 99.7th percentile), and references include patch commits and vendor advisories, indicating public technical detail but no confirmed in-the-wild exploitation in this record.

What to do

• Upgrade nghttp2 to version 1.61.0 or later, which limits CONTINUATION frames accepted per stream.
• Apply the vendor patches referenced in the nghttp2 commits and advisory GHSA-x6x3-gv8h-m57q.
• Update distribution packages (Debian, Fedora) to the fixed versions announced in their security lists.
• If immediate patching is not possible, reduce exposure of HTTP/2 endpoints and monitor for abnormal CONTINUATION frame volume; note the record states there is no workaround.

Detection

• Monitor HTTP/2 servers for spikes in CONTINUATION frames per stream or per connection.
• Alert on sustained high CPU usage in processes linked to nghttp2-based HTTP/2 services.
• Track connections that send CONTINUATION frames after RST_STREAM, which is abnormal behavior.
• Review HTTP/2 server logs for repeated stream resets followed by continued frame processing.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.