PT-2018-9338 · Nghttp2+2 · Nghttp2+2

James M Snell + 1 · Published 2016-12-01 · Updated 2026-05-18 · CVE-2018-1000168

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions nghttp2 versions 1.10.0 through 1.31.0

Description The issue is related to improper input validation in ALTSVC frame handling, which can cause a segmentation fault and lead to denial of service. This can be exploited via a network client.

Recommendations For nghttp2 versions 1.10.0 through 1.31.0, update to version 1.31.1 or later to resolve the issue.

Fix

DoS

RCE

NULL Pointer Dereference

Weakness Enumeration

CWE-20

CWE-476

Related Identifiers

ALT-PU-2016-2380

ALT-PU-2018-1961

ALT-PU-2018-2455

ALT-PU-2018-2749

CLEANSTART-2026-BD71263

CLEANSTART-2026-IS74202

CLEANSTART-2026-JR35772

CLEANSTART-2026-JY06700

CLEANSTART-2026-KN34553

CLEANSTART-2026-KZ45320

CLEANSTART-2026-LJ44720

CLEANSTART-2026-LN12820

CLEANSTART-2026-TX00223

CLEANSTART-2026-WI75198

CVE-2018-1000168

DLA-2786-1

OPENSUSE-SU-2018_1963-1

OPENSUSE-SU-2024:11091-1

RHSA-2019:0367

SUSE-SU-2018:1918-1

SUSE-SU-2018_1918-1

SUSE-SU-2019:14246-1

SUSE-SU-2019_14246-1

SUSE-SU-2021:0932-1

Affected Products

Alt Linux

Suse

Nghttp2

References · 406

• https://nvd.nist.gov/vuln/detail/CVE-2021-22931 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-24807 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9514 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-37372 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9516 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23918 · Security Note
• https://ubuntu.com/security/CVE-2018-1000168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000168 · Security Note
• https://access.redhat.com/errata/RHSA-2019:0367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000168 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22018 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-27982 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36138 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-9511 · Security Note
• https://cve.org/CVERecord?id=CVE-2018-1000168 · Security Note