VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago
Reset
More filters (1)
Columns
Oracle product: Oracle Communications / Routing (Nghttp2)✕
Overview 3 matches · 1 in RASP scope · 0 protected · 1 KEV · 1 public PoC · 1 CISA SSVC · 2 EPSS ≥ 0.5 · 0 disputed
3matches 1in RASP scope33.3% 0protected0.0% 1KEV33.3% 1public PoC33.3% 1CISA SSVC33.3% 2EPSS ≥ 0.566.7% 0disputed0.0%
Critical 0 0.0% High 2 66.7% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 2 66.7% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 33.3% No public exploit 1 33.3%
split by peak 1 / quarter
Unknown: 0None: 0Low: 0Medium: 1High: 2Critical: 0 Rejected: 0Out of RASP scope: 0Not applicable: 2Queued for review: 0Mitigated by environment configuration: 0No fix identified: 0No exploit published: 0Mitigation candidate: 1Rule in development: 0Protected by RASP: 0 unrecorded: 0not established: 0not blocked: 3blocked by ARMR today: 0 No public exploit: 1Forecast only: 1Proof of concept only: 0Working exploit published: 0Exploited in the wild: 1 Q4 2023: 1 CVE Q1 2024: 0 CVEs Q2 2024: 1 CVE Q3 2024: 0 CVEs Q4 2024: 0 CVEs Q1 2025: 0 CVEs Q2 2025: 0 CVEs Q3 2025: 0 CVEs Q4 2025: 0 CVEs Q1 2026: 1 CVE
Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25Q4 25Q1 26
3 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2026-27135 High 2026-03-18 Not applicable No public exploit nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
CVE-2024-28182 Medium 2024-04-04 Not applicable Forecast only nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited in the wild The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.