CVE-2018-16844

30

FAUCET Score

CVE-2018-16844 is a high-severity vulnerability affecting nginx versions prior to 1.15.6 and 1.14.1, specifically when compiled with the ngx_http_v2_module and using the 'http2' option. This flaw allows for excessive CPU usage, leading to a denial-of-service condition. The attack is network-based, requires no user interaction, and has a CVSS score of 7.5. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.9.5, < 1.14.1CPE matchmatch criteria	cpe:2.3:a:f5:nginx::::::::
		>= 1.15.0, < 1.15.6CPE matchmatch criteria	cpe:2.3:a:f5:nginx::::::::
		9.0CPE matchmatch criteria	cpe:2.3:o:debian:debian_linux:9.0:::::::*
		14.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
		16.04CPE matchmatch criteria	cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::

CVSS Data

CVSS version used by this source: 3.0

5.3MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

Exploitability Score

3.9

Impact Score

1.4

CvssVersion

3.0

Exploit Intelligence

EPSS Score

12.40%

Probability of exploitation in next 30 days

EPSS Percentile

95.8%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.1240 is in the 94th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (17)

netgearpatch availablevia llm_extracted

Fixed in: 1.15.6+, 1.14.1+

opensshpatch availablevia llm_extracted

Fixed in: 1.15.6

power_bipatch availablevia llm_extracted

Fixed in: 1.14.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-nginx114-nginx-1:1.14.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-nginx112-nginx-1:1.12.1-2.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUSFixed in: rh-nginx114-nginx-1:1.14.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nginx114-nginx-1:1.14.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nginx112-nginx-1:1.12.1-2.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUSFixed in: rh-nginx112-nginx-1:1.12.1-2.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: rh-nginx114-nginx-1:1.14.1-1.el7

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUSFixed in: rh-nginx112-nginx-1:1.12.1-2.el7.1

terraformpatch availablevia llm_extracted

Fixed in: 1.15.6

dahuavendor investigatingvia llm_extracted

Fixed in: 1.14.1+

dfinityvendor investigatingvia llm_extracted

Fixed in: 1.15.6

jfrogvendor investigatingvia llm_extracted

Fixed in: 1.15.6

liferayvendor investigatingvia llm_extracted

Fixed in: 1.14.1

redhatend of lifevia redhat_api

Product: Red Hat Software CollectionsFixed in: rh-nginx110-nginx

Vendor Advisories (9)

redhatCVE-2018-16844Moderate

nginx: Excessive CPU usage via flaw in HTTP/2 implementation

opensshllm-openssh-2c16c8ec07730b0dLOW

Excessive CPU usage in HTTP/2

dfinityllm-dfinity-a9b854afc8837ebbLOW

Excessive CPU usage in HTTP/2

power_billm-power_bi-1c31b418ae75abceLOW

Excessive CPU usage in HTTP/2

liferayllm-liferay-81227b384ed4bcabLOW

Excessive CPU usage in HTTP/2

jfrogllm-jfrog-fa8b907ed8739d78LOW

Excessive CPU usage in HTTP/2

dahuallm-dahua-1abda7ac83d3d5aaLOW

Excessive CPU usage in HTTP/2

terraformllm-terraform-1e9fc76f0d7b1ba6LOW

Excessive CPU usage in HTTP/2

netgearllm-netgear-34739e880fdb3021LOW

Excessive CPU usage in HTTP/2

References

lists.opensuse.org / opensuse-security-announce/2019-09/msg00035.html

Third Party Advisory

mailman.nginx.org / pipermail/nginx-announce/2018/000220.html

Mailing ListVendor Advisory

access.redhat.com / errata/RHSA-2018:3680

Third Party Advisory

access.redhat.com / errata/RHSA-2018:3681

Third Party Advisory

bugzilla.redhat.com / show_bug.cgi

Issue Tracking

seclists.org / fulldisclosure/2021/Sep/36

Mailing ListThird Party Advisory

support.apple.com / kb/HT212818

Third Party Advisory

usn.ubuntu.com / 3812-1

Third Party Advisory

debian.org / security/2018/dsa-4335

Third Party Advisory

securityfocus.com / bid/105868

Third Party AdvisoryVDB Entry

securitytracker.com / id/1042038

Third Party AdvisoryVDB Entry