The version of nghttp2 installed on the remote host is prior to 1.41.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1445 advisory.

    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2848 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: nodejs (10.21.0).

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2786 advisory.

  - nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20     vulnerability in ALTSVC frame handling that can result in segmentation fault leading to denial of service.
    This attack appears to be exploitable via network client. This vulnerability appears to have been fixed in     >= 1.31.1. (CVE-2018-1000168)

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2895 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs12-nodejs (12.18.2).

    Security Fix(es):

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: TLS session reuse can lead to hostname verification bypass (CVE-2020-8172)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2784 advisory.

    libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

    Security Fix(es):

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3084 advisory.

    Node.js is a software development platform for building fast and scalable network applications in the     JavaScript programming language.

    The following packages have been upgraded to a later upstream version: rh-nodejs10-nodejs (10.21.0).

    Security Fix(es):

    * ICU: Integer overflow in UnicodeString::doAppend() (CVE-2020-10531)

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

    * nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

    * nodejs: memory corruption in napi_get_value_string_* functions (CVE-2020-8174)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:2755 advisory.

  - In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection. (CVE-2020-11080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0101 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2019-9513:
    Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.
    The attacker creates multiple request streams and continually shuffles the priority of the streams in a     way that causes substantial churn to the priority tree. This can consume excess CPU.

    CVE-2020-11080:
    In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service.
    The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of     14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at     100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement     nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of     settings entries are large (e.g., > 32), then drop the connection.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3621 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3621-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                         Sean Whitton     October 16, 2023                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : nghttp2     Version        : 1.36.0-2+deb10u2     CVE ID         : CVE-2020-11080 CVE-2023-44487     Debian Bug     : 962145 1053769

    Multiple vulnerabilities were discovered in nghttp2, an implementation     of the HTTP/2 protocol.

    CVE-2020-11080

        A denial-of-service could be caused by a large HTTP/2 SETTINGS         frame payload.

    CVE-2023-44487

        A denial-of-service could be caused by resetting many HTTP/2         streams quickly.  This has been observed in the wild since August.

    For Debian 10 buster, these problems have been fixed in version     1.36.0-2+deb10u2.

    We recommend that you upgrade your nghttp2 packages.

    For the detailed security status of nghttp2 please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/nghttp2

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the cmake package has been released.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-196:01 advisory.

    * nghttp2: overly large SETTINGS frames can lead to DoS (CVE-2020-11080)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
138047	Amazon Linux 2 : nghttp2 (ALAS-2020-1445)	Nessus	Amazon Linux Local Security Checks	7/2/2020	12/11/2024	high
138172	RHEL 8 : nodejs:10 (RHSA-2020:2848)	Nessus	Red Hat Local Security Checks	7/7/2020	3/13/2025	high
154195	Debian DLA-2786-1 : nghttp2 - LTS security update	Nessus	Debian Local Security Checks	10/17/2021	12/5/2022	high
170284	RHEL 7 : rh-nodejs12-nodejs (RHSA-2020:2895)	Nessus	Red Hat Local Security Checks	1/23/2023	11/8/2024	high
170295	RHEL 6 / 7 : httpd24-nghttp2 (RHSA-2020:2784)	Nessus	Red Hat Local Security Checks	1/23/2023	11/7/2024	high
170336	RHEL 7 : rh-nodejs10-nodejs (RHSA-2020:3084)	Nessus	Red Hat Local Security Checks	1/23/2023	11/7/2024	high
184573	Rocky Linux 8 : nghttp2 (RLSA-2020:2755)	Nessus	Rocky Linux Local Security Checks	11/6/2023	12/22/2023	high
238668	TencentOS Server 3: nghttp2 (TSSA-2022:0101)	Nessus	Tencent Local Security Checks	6/16/2025	11/22/2025	high
183195	Debian dla-3621 : libnghttp2-14 - security update	Nessus	Debian Local Security Checks	10/16/2023	1/22/2025	critical
332524	Photon OS 5.0: Cmake PHSA-2023-5.0-91-0035	Nessus	PhotonOS Local Security Checks	8/5/2026	8/6/2026	critical
294160	MiracleLinux 7 : httpd24-nghttp2-1.7.1-8.el7.1 (AXSA:2020-196:01)	Nessus	Miracle Linux Local Security Checks	1/20/2026	1/21/2026	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

critical

critical

high