NetSight
IP …
high7.5

CVE-2018-16843

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption.

Impact

nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

Affected products

VendorProductAffected versions
F5Nginx
after 1.9.5 before 1.14.1
after 1.15.0 before 1.15.6
DebianDebian Linux
Version 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 18.10
OpensuseLeap
Version 15.1
AppleXcode
before 13.0

Weakness classification

CWE-400

References