[ GLSA 201612-13 ] nghttp2

[GLSA]

Gentoo Linux Security Advisory

Title: nghttp2: Denial of Service (GLSA 201612-13)
Severity: normal
Exploitable: remote
Date: December 05, 2016
Bug(s): #574780
ID: 201612-13

Synopsis

Nghttp2 is vulnerable to a Denial of Service attack.

Background

Nghttp2 is an implementation of HTTP/2 and its header compression
algorithm HPACK in C.


Affected Packages

Package: net-libs/nghttp2
Vulnerable: < 1.7.1
Unaffected: >= 1.7.1
Architectures: All supported architectures


Description

Nghttpd, nghttp, and libnghttp2_asio applications do not limit the
memory usage for the incoming HTTP header field. If a peer sends a
specially crafted HTTP/2 HEADERS frame and CONTINUATION frame, they will
crash with an out of memory error.


Impact

A remote attacker could possibly cause a Denial of Service condition.

Workaround

There is no known workaround at this time.

Resolution

All nghttp2 users should upgrade to the latest version: