CLSA-2026-1788175030

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1788175030
Upstream
CVE (3)
Published
2026-08-31T11:17:24Z
Modified
2026-10-26T09:32:04Z
Summary
Fix CVE(s): CVE-2020-11080, CVE-2023-35945, CVE-2023-44487
Details
  • SECURITY UPDATE: denial of service via HTTP/2 stream reset flood (Rapid Reset)
    • debian/patches/CVE-2023-44487.patch: rate-limit incoming RST_STREAM on server sessions with a token bucket (burst 1000, 33 tokens per second) and send GOAWAY once it is exhausted, adding the nghttp2_ratelim and nghttp2_time modules and the clock_gettime / GetTickCount64 probes they need. Backported without upstream's new public option setter, so debian/libnghttp2-14.symbols is unchanged.
    • CVE-2023-44487
References

Affected packages

TuxCare:Ubuntu:18.04
libnghttp2-14

Package

Name
libnghttp2-14
Purl
pkg:deb/tuxcare/libnghttp2-14?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"
libnghttp2-dev

Package

Name
libnghttp2-dev
Purl
pkg:deb/tuxcare/libnghttp2-dev?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"
libnghttp2-doc

Package

Name
libnghttp2-doc
Purl
pkg:deb/tuxcare/libnghttp2-doc?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"
nghttp2

Package

Name
nghttp2
Purl
pkg:deb/tuxcare/nghttp2?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"
nghttp2-client

Package

Name
nghttp2-client
Purl
pkg:deb/tuxcare/nghttp2-client?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"
nghttp2-proxy

Package

Name
nghttp2-proxy
Purl
pkg:deb/tuxcare/nghttp2-proxy?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"
nghttp2-server

Package

Name
nghttp2-server
Purl
pkg:deb/tuxcare/nghttp2-server?distro=ubuntu-18.04

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30.0-1ubuntu1+tuxcare.els3

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"