Excessive CPU Usage in nginx HTTP/2 Implementation (CVE-2018-16844)
Summary
CVE-2018-16844: nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive CPU usage. Affects nginx across 2 version ranges.
< 1.14.1-r0
>= 658813c43b9c930c8fad2cd04600d1aba2ef031b, < 79b5093854dbbae2e8a53df1b08d2ec466b124ba
Fixed in 1.14.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nginx is a popular open-source web server and reverse proxy server. It is known for its high performance, stability, and scalability. The HTTP/2 protocol is supported by nginx through the ngx_http_v2_module. This vulnerability affects nginx versions before 1.15.6 and 1.14.1 when compiled with the ngx_http_v2_module and the 'http2' option of the 'listen' directive is used in the configuration file.
Vulnerability Detail
The vulnerability in the HTTP/2 implementation of nginx can lead to excessive CPU usage. An attacker can exploit this issue by sending specially crafted HTTP/2 requests, causing the server to consume excessive CPU resources. This can result in degraded performance and denial of service conditions. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity.
How To Fix
Minimum fixed version
1.14.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade nginxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest nginx version is not immediately possible, a temporary workaround is to disable the 'http2' option in the 'listen' directive of the nginx configuration file. This can be done by removing or commenting out the 'http2' option. However, this workaround will disable HTTP/2 support in nginx.
Conclusion
The vulnerability in the HTTP/2 implementation of nginx can result in excessive CPU usage and potential denial of service conditions. It is crucial to upgrade to the latest nginx version or apply the recommended workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nginx →
FAQ
nginx is a popular open-source web server and reverse proxy server known for its high performance, stability, and scalability.
HTTP/2 is a major revision of the HTTP protocol that offers improved performance, multiplexing, and server push capabilities.
This vulnerability affects nginx versions before 1.15.6 and 1.14.1 when compiled with the ngx_http_v2_module and the 'http2' option of the 'listen' directive is used in the configuration file. It can lead to excessive CPU usage and potential denial of service conditions.
The CVSSv3 score of this vulnerability is 7.5, indicating a high severity.
To fix this vulnerability, it is recommended to upgrade to nginx version 1.14.1 or later. Alternatively, you can temporarily disable the 'http2' option in the nginx configuration file as a workaround.
Related vulnerabilities
Recent vulnerabilities recorded for nginx.
