Nghttp2

Nghttp2 is a compact but broadly embedded HTTP/2 protocol library that sits deep in the software supply chain across servers, proxies, and client applications, making its security footprint disproportionate to its product count. Vulnerabilities affecting the library skew toward serious outcomes, with an elevated tendency to reach critical severity, acquire public exploit code, and be confirmed as exploited in the wild. The recurring weakness classes—uncontrolled resource consumption, resource allocation without throttling, improper input validation, and buffer-boundary violations—reflect the parsing and state-management complexity inherent to HTTP/2 frame processing, and a single flaw can propagate rapidly across all downstream consumers of the library. Defenders should monitor this vendor's advisories closely and prioritize remediation in internet-facing services, since patches typically require downstream rebuilds; live severity, exploitation, and exposure counts are shown alongside this summary.