CVE-2018-1000168 - CVE House
Back to Database
Status published Unknown CVE-2018-1000168

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an...

Vulnerability Description

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000168

Credits & Attribution

No credits recorded in the NVD database.

References

More from nghttp2

View All →
CVE-2024-28182
Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
Medium 5.3
CVE-2020-11080
Denial of service in nghttp2
Low 3.7
CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial...
Low 3.3

Affected Vendor

Affected Software

nghttp2, node.js, debian linux
Vulnerable Versions:
1.10.0, 6.0.0, 8.4.0, 9.0.0, 10.0.0, 9.0

Timeline

Official Publish: May 8th, 2018
Last Modified: June 9th, 2025
Added to House: July 20th, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.