CVE-2024-28182

CVE-2024-28182 is a medium-severity denial-of-service (DoS) vulnerability affecting the nghttp2 library prior to version 1.61.0, as well as various Debian and Fedora distributions. It allows an attacker to cause excessive CPU usage by sending an unbounded number of HTTP/2 CONTINUATION frames, even after a stream reset, leading to service disruption. The vulnerability has a CVSS score of 5.3 (Medium) and can be exploited remotely without authentication or user interaction. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of interest and potential for future exploitation.