Test ID:	1.3.6.1.4.1.25623.1.0.140984
Category:	Web application abuses
Title:	nghttp2 < 1.31.1 DoS Vulnerability
Summary:	nghttpd2 is prone to a denial of service vulnerability due to a NULL pointer;deference.
Description:	Summary: nghttpd2 is prone to a denial of service vulnerability due to a NULL pointer deference. Vulnerability Insight: If ALTSVC frame is received by libnghttp2 and it is larger than it can accept, the pointer field which points to ALTSVC frame payload is left NULL. Later libnghttp2 attempts to access another field through the pointer, and gets segmentation fault. Affected Software/OS: nghttpd2 version 1.10.0 until 1.31.0. Solution: Update to version 1.31.1 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2018-1000168 BugTraq ID: 103952 http://www.securityfocus.com/bid/103952 https://lists.debian.org/debian-lts-announce/2021/10/msg00011.html RedHat Security Advisories: RHSA-2019:0366 https://access.redhat.com/errata/RHSA-2019:0366 RedHat Security Advisories: RHSA-2019:0367 https://access.redhat.com/errata/RHSA-2019:0367
Copyright	Copyright (C) 2018 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.