CVE-2024-27983
highpriority · track · 41EPSS 0.872 · 100 %ileexploit · PoCDEEUNLRUUSEPSS · scored 2026-10-22
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSINEC INSsiemens_psirt
Update to V1.0 SP2 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109975745/ - FixedSINEC INScisa_csaf_ot
Update to V1.0 SP2 Update 3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109975745/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.3–8.2
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (1)
Public proof-of-concept and weaponised exploit code.
affected products (69)
Products and version ranges known to be affected.
advisories (12)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0301Kwetsbaarheden verholpen in Oracle Java SENL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle Java SE.
- NCSC-2024-0411Kwetsbaarheden verholpen in Oracle Database productenNL2024-10-17csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in diverse Database producten en subsystemen, zoals de Core database, Application Express, Autonomous Health Framework, Essbase, GoldenGate, SQL Developer en Secure Backup.
- NCSC-2024-0433Kwetsbaarheden verholpen in Siemens productenNL2024-11-12csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDCOM, SCALANCE, SIMATIC en SINEC.
- NCSC-2025-0026Kwetsbaarheden verholpen in Oracle JD EdwardsNL2025-01-22csaf · ncsc_nlNL
Oracle heeft kwetsbaarheden verholpen in JD Edwards EnterpriseOne Tools (specifiek voor versies prior tot 9.2.9.2).
- SSA-915275SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 32024-11-12csaf · siemens_psirtDE
SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.
- WID-SEC-W-2024-0776Node.js: Mehrere SchwachstellenDeutsch2024-04-03csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Node.js ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2024-1648Azul Zulu: Mehrere Schwachstellen ermöglichen Denial of ServiceDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Azul Zulu ausnutzen, um einen Denial of Service Angriff durchzuführen.
- WID-SEC-W-2024-1658Oracle Java SE: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Java SE ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-0168Oracle JD Edwards: Mehrere SchwachstellenDeutsch2025-01-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- ICSA-24-319-08Siemens SINEC INS2024-11-12icsa · cisa_csaf_otUS
SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.
- BIT-node-2024-279832024-06-04vendor · osvUS
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
- BIT-node-min-2024-279832024-12-16vendor · osvUS
An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a TCP connection is abruptly closed by the client triggering the Http2Session destructor while header frames are still being processed (and stored in memory) causing a race condition.
also known as (6)
Other names and identifiers for this entity.
- CNNVD-202404-991cnnvd
- EUVD-2024-25157enisa_euvd
- BDU:2024-02689fstec_bdu
- GHSA-j65r-8hrg-qc6xenisa_euvd
- BIT-node-2024-27983osv
- BIT-node-min-2024-27983osv
sources
Which sources assert this record, and when.
references (18)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-27983/cnnvd
- https://hackerone.com/reports/2319584cnnvd
- https://nodejs.org/en/blog/vulnerability/april-2024-security-releasesPatchcnnvd
- https://vigilance.fr/vulnerability/Node-js-Core-two-vulnerabilities-dated-03-04-2024-43952cnnvd
- https://www.oracle.com/security-alerts/cpujan2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujul2024.htmlcnnvd
- http://www.openwall.com/lists/oss-security/2024/04/03/16enisa_euvd
- https://hackerone.com/reports/2319584enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan