nghttp2 nghttp2

Name: nghttp2 nghttp2
Brand: nghttp2

productUS

cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

1critical4high0medium1low

updated 2026-10-28

vulnerabilities (9)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-44487US	high7.5OT critical	100.0% (100th)	KEV	1.57.0	2023-10-10	< 1.57.0
CVE-2024-28182US	—	85.0% (100th)	—	1.61.0	2024-04-04	< 1.61.0
CVE-2018-1000168US	high7.5	10.6% (96th)	—	no fix	2018-05-08	1.10.0 → 1.31.0
CVE-2020-11080US	high7.5	5.32% (93rd)	—	1.41.0	2020-06-03	< 1.41.0
CVE-2015-8659US	critical10.0	3.96% (90th)	—	no fix	2016-01-12	≤ 1.5.0
CVE-2023-35945US	high7.5	1.65% (76th)	—	1.55.1	2023-07-13	< 1.55.1
CVE-2016-1544US	low3.3	0.89% (59th)	—	1.7.1	2020-02-06	< 1.7.1
CVE-2026-27135US	—	0.80% (57th)	—	1.68.1	2026-03-18	< 1.68.1
CVE-2026-58055US	—	0.25% (17th)	—	no fix	2026-06-28	≤ 1.69.0

The flaw types (CWEs) most of these CVEs share.

CWE-400Uncontrolled Resource Consumption5 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer1 CVEs
CWE-20Improper Input Validation1 CVEs
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')1 CVEs
CWE-459Incomplete Cleanup1 CVEs
CWE-476NULL Pointer Dereference1 CVEs
CWE-617Reachable Assertion1 CVEs
CWE-707Improper Neutralization1 CVEs

Which sources assert this record, and when.

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.