CVE-2018-16843 is a high-severity vulnerability in nginx versions prior to 1.15.6 and 1.14.1, specifically affecting installations compiled with the ngx_http_v2_module and using the 'http2' option. This flaw allows for excessive memory consumption, leading to a denial of service. The vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, impacting products from Apple, Canonical, Debian, F5, and OpenSUSE. While no public exploit code or active exploitation is reported, it has garnered significant community discussion and media coverage, indicating awareness of its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
> 1.9.5, < 1.14.1CPE matchmatch criteria | cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* | ||
> 1.15.0, < 1.15.6CPE matchmatch criteria | cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
14.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* | ||
16.04CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
nginx: Excessive memory consumption via flaw in HTTP/2 implementation
Nov 6, 2018Excessive memory usage in HTTP/2
Jan 1, 2018Excessive memory usage in HTTP/2
Jan 1, 2018Excessive memory usage in HTTP/2
Jan 1, 2018Excessive memory usage in HTTP/2
Jan 1, 2018Excessive memory usage in HTTP/2
Jan 1, 2018Excessive memory usage in HTTP/2
Excessive memory usage in HTTP/2
Excessive memory usage in HTTP/2