CVE-2016-1544

CVE-2016-1544: vulnerability in nghttp2

Published · Updated

Follow this CVE+ Monitor nghttp2+ Monitor nghttp2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.9%
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion).
Affected products
nghttp2 · nghttp2
Related CVEs — nghttp2

In the same product, most dangerous first.

CVE-2024-28182MEDIUMReading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usageEPSS 82.0%CVE-2020-11080LOWDenial of service in nghttp2EPSS 5.3%CVE-2026-27135HIGHnghttp2 Denial of service: Assertion failure due to the missing state validationEPSS 0.8%CVE-2026-58055MEDIUMnghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-LengthEPSS 0.3%