nginx nginx CVE-2018-16843 vulnerability in NGINX and Other Products
Published on November 7, 2018

product logo product logo product logo product logo product logo product logo
nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the 'http2' option of the 'listen' directive is used in a configuration file.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Weakness Type

What is a Resource Exhaustion Vulnerability?

The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

CVE-2018-16843 has been classified to as a Resource Exhaustion vulnerability or weakness.


Products Associated with CVE-2018-16843

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2018-16843 are published in these products:

nginx
 
Canonical Ubuntu Linux
 
Debian Linux
 
OpenSuse Leap
 
F5 Networks Nginx
 
Apple Xcode
 

Affected Versions

[UNKNOWN] nginx:

Exploit Probability

EPSS
55.54%
Percentile
98.10%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.