CVE-2024-28182: 
MySQL vulnerability analysis and mitigation

nghttp2, an implementation of the Hypertext Transfer Protocol version 2 in C, was found to contain a vulnerability (CVE-2024-28182) where the library keeps reading an unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This vulnerability affects versions prior to 1.61.0 and was discovered by Bartek Nowotarski (CERT Advisory, GitHub Advisory).

The vulnerability stems from the library's handling of HTTP/2 CONTINUATION frames. When processing header blocks that are split across multiple frames, the implementation continues to read and decode CONTINUATION frames without proper limits, even after a stream reset. This behavior is maintained to keep the HPACK (HTTP/2 header compression) context synchronized. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (GitHub Advisory).

The vulnerability can lead to excessive CPU usage when decoding the HPACK stream, potentially resulting in a Denial of Service (DoS) condition. An attacker can exploit this by sending a continuous stream of CONTINUATION frames to consume server resources (GitHub Advisory).

The vulnerability can be exploited remotely by an attacker who can send packets to a target server. The attack involves sending a stream of CONTINUATION frames without requiring any special privileges or user interaction (CERT Advisory).

The vulnerability has been fixed in nghttp2 version 1.61.0, which mitigates the issue by limiting the number of CONTINUATION frames it can accept after a HEADERS frame. The limit is configurable and defaults to 8. There are no workarounds available for this vulnerability; upgrading to version 1.61.0 or later is recommended (GitHub Advisory).