x/vulndb: potential Go vuln in github.com/nghttp2/nghttp2: CVE-2024-28182

[GoVulnBot]

CVE-2024-28182 references github.com/nghttp2/nghttp2, which may be a Go module.

Description:
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-28182
• JSON: https://github.com/CVEProject/cvelist/tree/996deaba66dc11a75b71f65bae13eb2559b34e4e/2024/28xxx/CVE-2024-28182.json
• advisory: GHSA-x6x3-gv8h-m57q
• fix: nghttp2/nghttp2@00201ec
• fix: nghttp2/nghttp2@d71a466
• Imported by: https://pkg.go.dev/github.com/nghttp2/nghttp2?tab=importedby

Cross references:

• Module github.com/nghttp2/nghttp2 appears in issue x/vulndb: potential Go vuln in github.com/nghttp2/nghttp2: GHSA-vx74-f528-fxqg #2108 NOT_GO_CODE
• Module github.com/nghttp2/nghttp2 appears in issue x/vulndb: potential Go vuln in github.com/nghttp2/nghttp2: CVE-2016-1544 #2190 LEGACY_FALSE_POSITIVE
• Module github.com/nghttp2/nghttp2 appears in issue x/vulndb: potential Go vuln in github.com/nghttp2/nghttp2: CVE-2017-2428 #2200 LEGACY_FALSE_POSITIVE
• Module github.com/nghttp2/nghttp2 appears in issue x/vulndb: potential Go vuln in github.com/nghttp2/nghttp2: CVE-2020-11080 #2268 LEGACY_FALSE_POSITIVE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/nghttp2/nghttp2
      vulnerable_at: 1.61.0
      packages:
        - package: nghttp2
cves:
    - CVE-2024-28182
references:
    - advisory: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-x6x3-gv8h-m57q
    - fix: https://github.com/nghttp2/nghttp2/commit/00201ecd8f982da3b67d4f6868af72a1b03b14e0
    - fix: https://github.com/nghttp2/nghttp2/commit/d71a4668c6bead55805d18810d633fbb98315af9

[gopherbot]

Change https://go.dev/cl/590855 mentions this issue: data/excluded: add 20 excluded reports