CVE-2018-16843

Name of the Vulnerable Software and Affected Versions nginx versions prior to 1.15.6 nginx versions prior to 1.14.1

Description The issue is related to the implementation of the HTTP/2 protocol in the nginx server, which can lead to uncontrolled resource consumption. This can allow a remote attacker to cause a denial of service. The problem affects nginx servers compiled with the ngx http v2 module, when the 'http2' option of the 'listen' directive is used in a configuration file.

Recommendations For versions prior to 1.15.6, update to version 1.15.6 or later. For versions prior to 1.14.1, update to version 1.14.1 or later. As a temporary workaround, consider disabling the ngx http v2 module module or removing the 'http2' option from the 'listen' directive in the configuration file until a patch is available.