Skip to content
Fencer Vulns
high 7.5

CVE-2018-1000168 in the critical feed json

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that c…

published 2018-05-08 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1868

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
10.6%
EPSS 10.6% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

Patch / fix

  • nodejs node.js 10.4.1
  • nghttp2 Debian 14, Debian 13, Debian 12 1.31.1-1

debian advisories DEBIAN-CVE-2018-1000168

  • nghttp2 Ubuntu 18.04 LTS 1.30.0-1ubuntu1

ubuntu advisories UBUNTU-CVE-2018-1000168

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • jbcs-httpd24 jboss core services 1 1-6.jbcs.el6
  • jbcs-httpd24 jboss core services 1 1-6.jbcs.el7
  • jbcs-httpd24-apr jboss core services 1 1.6.3-31.jbcs.el6
  • jbcs-httpd24-apr jboss core services 1 1.6.3-31.jbcs.el7
  • jbcs-httpd24-httpd jboss core services 1 2.4.29-35.jbcs.el6
  • jbcs-httpd24-httpd jboss core services 1 2.4.29-35.jbcs.el7
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.46-1.redhat_1.jbcs.el6
  • jbcs-httpd24-mod_jk jboss core services 1 1.2.46-1.redhat_1.jbcs.el7

red hat advisories RHSA-2019:0367

  • nghttp2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +13 more 1.39.2-3.5.1
  • nodejs8 SLE Module for Web and Scripting 15 8.11.3-3.5.1
  • firefox-atk SLES 11 SP4-LTSS 2.26.1-2.8.4
  • mozilla-nss SLES 11 SP4-LTSS 3.45-38.9.3
  • firefox-gtk3 SLES 11 SP4-LTSS 3.10.9-2.15.3
  • mozilla-nspr SLES 11 SP4-LTSS 4.21-29.6.1
  • firefox-cairo SLES 11 SP4-LTSS 1.15.10-2.13.4
  • firefox-glib2 SLES 11 SP4-LTSS 2.54.3-2.14.7

suse advisories SUSE-SU-2021:0932-1SUSE-SU-2019:14246-1SUSE-SU-2018:1918-1

  • nghttp2 openSUSE Tumbleweed 1.43.0-1.6

opensuse advisories openSUSE-SU-2024:11091-1

  • nodejs Alpine 3.24, Alpine 3.23, Alpine 3.22 +14 more 8.11.3-r0

alpine advisories ALPINE-CVE-2018-1000168

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000168 updated cvss 5.9

nghttp2: Null pointer dereference when too large ALTSVC frame is received

  • Red Hat JBoss Core Services
    fixed: vendor fix RHSA-2019:0366
  • Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24 1-6.jbcs.el6, jbcs-httpd24-runtime 1-6.jbcs.el6, jbcs-httpd24-apr 1.6.3-31.jbcs.el6, jbcs-httpd24-httpd 2.4.29-35.jbcs.el6, jbcs-httpd24-nghttp2 1.29.0-9.jbcs.el6, jbcs-httpd24-apr-util 1.6.1-24.jbcs.el6, +22 more Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24 1-6.jbcs.el7, jbcs-httpd24-runtime 1-6.jbcs.el7, jbcs-httpd24-apr 1.6.3-31.jbcs.el7, jbcs-httpd24-httpd 2.4.29-35.jbcs.el7, jbcs-httpd24-nghttp2 1.29.0-9.jbcs.el7, jbcs-httpd24-apr-util 1.6.1-24.jbcs.el7, +22 more
    fixed: vendor fix RHSA-2019:0367
  • Red Hat Enterprise Linux 8 nghttp2, libnghttp2 Red Hat Software Collections rh-nodejs8-npm, httpd24-nghttp2, rh-nodejs8-nodejs, httpd24-libnghttp2
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
17 mo ago

Exploit prediction

10.58% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:N/A:P

Classification

Weakness
  • CWE-476 NULL Pointer Dereference
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.