Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-1000168

29
FAUCET Score

CVE-2018-1000168 is an Improper Input Validation vulnerability (CWE-20) in nghttp2 versions 1.10.0 through 1.31.0, specifically within its ALTSVC frame handling. This flaw can lead to a segmentation fault and subsequent denial of service (DoS) when exploited via a network client. The vulnerability is rated High severity (CVSS 7.5) due to its network-based attack vector and potential for complete service disruption. While the EPSS score is low, indicating a low probability of exploitation, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. A fix was released in nghttp2 version 1.31.1.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.10.0, <= 1.31.0CPE matchmatch criteria
cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*
>= 6.0.0, <= 6.8.1CPE matchmatch criteria
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*
>= 8.4.0, <= 8.17.0CPE matchmatch criteria
cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*
>= 9.0.0, <= 9.11.2CPE matchmatch criteria
cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*
>= 10.0.0, < 10.4.1CPE matchmatch criteria
cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
10.65%
Probability of exploitation in next 30 days
EPSS Percentile
95.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.1065 is in the 93rd percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (21)

microsoftpatch availablevia msrc
Product: 16918-16820Fixed in: 14.17.2-1
microsoftpatch availablevia msrc
Product: cm1 nodejs 14.17.2-1 on CBL Mariner 1.0Fixed in: 14.17.2-1
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-0:1-6.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-0:1.6.3-31.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-apr-util-0:1.6.1-24.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-httpd-0:2.4.29-35.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.8-3.Final_redhat_2.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-mod_jk-0:1.2.46-1.redhat_1.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-nghttp2-0:1.29.0-9.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 6Fixed in: jbcs-httpd24-openssl-1:1.0.2n-14.jbcs.el6
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-0:1-6.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apache-commons-daemon-jsvc-1:1.1.0-3.redhat_2.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-0:1.6.3-31.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-apr-util-0:1.6.1-24.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-httpd-0:2.4.29-35.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_cluster-native-0:1.3.8-3.Final_redhat_2.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-mod_jk-0:1.2.46-1.redhat_1.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-nghttp2-0:1.29.0-9.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: JBoss Core Services on RHEL 7Fixed in: jbcs-httpd24-openssl-1:1.0.2n-14.jbcs.el7
View patch
redhatpatch availablevia redhat_api
Product: Text-Only JBCS
View patch

Vendor Advisories (2)

microsoft2018-May/CVE-2018-1000168Important

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service. This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in >= 1.31.1.

May 8, 2018
redhatCVE-2018-1000168Moderate

nghttp2: Null pointer dereference when too large ALTSVC frame is received

Apr 12, 2018

References

access.redhat.com / errata/RHSA-2019:0366
Third Party Advisory
access.redhat.com / errata/RHSA-2019:0367
Third Party Advisory
lists.debian.org / debian-lts-announce/2021/10/msg00011.html
Mailing ListThird Party Advisory
nghttp2.org / blog/2018/04/12/nghttp2-v1-31-1
Vendor Advisory
nodejs.org / en/blog/vulnerability/june-2018-security-releases
Release NotesThird Party Advisory
securityfocus.com / bid/103952
Broken LinkThird Party AdvisoryVDB Entry