CVE Tracker

CVE-2023-35945 @ Helios

Status
not_applicable
Priority
0.62
Match score
4.0
Risk
DoS Remote
CVSS
7.5 HIGH
Reason
cpe: nghttp2; pkgs: nghttp2-14; version: in-range: nghttp2-14-1.43.0-1+deb11u3; risk:dos
Created
2026-10-20T18:17:49Z
Updated
2026-10-21T16:44:00Z
Closed
2026-10-20T18:58:16Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

PackageCommands
nghttp2-14-1.43.0-1+deb11u3
nghttp2-14
libnghttp2-14-1.43.0-1+deb11u3

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Clear

Suggestions: nghttp2 · nghttp2-14

SystemMatchesTicket for CVE-2023-35945
Archive libnghttp2-14 1.36.0-2+deb10u3 not_applicable open
Bullseye libnghttp2-14 1.43.0-1+deb11u3 not_applicable open
Helios libnghttp2-14 1.43.0-1+deb11u3 not_applicable open
Library libnghttp2-14 1.18.1-1+deb9u2 not_applicable open
Matrix libnghttp2-14 1.52.0-1+deb12u3 not_applicable open
Silk libnghttp2-14 1.52.0-1+deb12u3 not_applicable open
morris alt-nghttp2 1.70.0; ea-libnghttp2 1.70.0; ea-libnghttp2-devel 1.70.0; ea-nghttp2 1.70.0; libnghttp2 1.33.0 not_applicable open
mufasa alt-nghttp2 1.70.0; ea-libnghttp2 1.70.0; ea-nghttp2 1.70.0; libnghttp2 1.33.0 not_applicable open
Janus libnghttp2-14 1.36.0-2+deb10u3 none
Saiph libnghttp2-14 1.36.0-2+deb10u3 none

Same product CVEs in your queue

Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.

CVECVSSKEVSystemsStatus MatchedAlready related
CVE-2026-27135 7.5 morris, mufasa not_applicable nghttp2 → CVE-2023-35945 linked here

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Other CVEs related to this one as primary:

Related CVENoteTickets
CVE-2026-27135 same product as CVE-2023-35945 morris, mufasa

Host OS / kernel

OS
Debian GNU/Linux 11 (bullseye) (11) · debian
Arch
aarch64
kernel_release
uname -r → 6.1.21-v8+
kernel_version
uname -v → #1642 SMP PREEMPT Mon Apr 3 17:24:16 BST 2023

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System Status Priority Updated
morris not_applicable 7.0 2026-10-21T16:44:00Z Open
mufasa not_applicable 7.0 2026-10-21T16:44:00Z Open
Silk not_applicable 4.0 2026-10-21T16:44:00Z Open
Library not_applicable 1.75 2026-10-21T16:44:00Z Open
Matrix not_applicable 1.75 2026-10-21T16:44:00Z Open
Archive not_applicable 0.62 2026-10-21T16:44:00Z Open
Bullseye not_applicable 0.62 2026-10-21T16:44:00Z Open

Description

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy’s HTTP/2 codec may leak a header map and bookkeeping structures upon receiving `RST_STREAM` immediately followed by the `GOAWAY` frames from an upstream server. In nghttp2, cleanup of pending requests due to receipt of the `GOAWAY` frame skips de-allocation of the bookkeeping structure and pending compressed header. The error return [code path] is taken if connection is already marked for not sending more requests due to `GOAWAY` frame. The clean-up code is right after the return statement, causing memory leak. Denial of service through memory exhaustion. This vulnerability was patched in versions(s) 1.26.3, 1.25.8, 1.24.9, 1.23.11.

Determination

System package is in range. The alt/ea trees are past the fix. CVE-2023-35945 is a memory leak in nghttp2 before 1.55.1. When a GOAWAY is received and a subsequent HEADERS/PUSH_PROMISE cannot be sent, cleanup of the stream bookkeeping and pending compressed header is skipped if the stream-close callback returns a fatal error. This can lead to memory exhaustion. You have nghttp2/libnghttp2 1.33.0 and alt-/ea- 1.70.0.

Update status

Also apply to other systems with this CVE:

Add note only

Also add note on:

Mitigation log

2026-10-20T18:58:16Z — not_applicable
System package is in range. The alt/ea trees are past the fix. CVE-2023-35945 is a memory leak in nghttp2 before 1.55.1. When a GOAWAY is received and a subsequent HEADERS/PUSH_PROMISE cannot be sent, cleanup of the stream bookkeeping and pending compressed header is skipped if the stream-close callback returns a fatal error. This can lead to memory exhaustion. You have nghttp2/libnghttp2 1.33.0 and alt-/ea- 1.70.0.

References

NVD: CVE-2023-35945