cve/2024/CVE-2024-27316.md

CVE-2024-27316

Description

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

POC

Reference

No PoCs from references.

Github

• https://github.com/Ampferl/poc_http2-continuation-flood
• https://github.com/DrewskyDev/H2Flood
• https://github.com/Vos68/HTTP2-Continuation-Flood-PoC
• https://github.com/aeyesec/CVE-2024-27316_poc
• https://github.com/lockness-Ko/CVE-2024-27316
• https://github.com/nomi-sec/PoC-in-GitHub