{"id":"CLSA-2026-1788175030","summary":"Fix CVE(s): CVE-2020-11080, CVE-2023-35945, CVE-2023-44487","details":"   * SECURITY UPDATE: denial of service via HTTP/2 stream reset flood\n     (Rapid Reset)\n     - debian/patches/CVE-2023-44487.patch: rate-limit incoming RST_STREAM\n       on server sessions with a token bucket (burst 1000, 33 tokens per\n       second) and send GOAWAY once it is exhausted, adding the\n       nghttp2_ratelim and nghttp2_time modules and the clock_gettime /\n       GetTickCount64 probes they need.  Backported without upstream's new\n       public option setter, so debian/libnghttp2-14.symbols is unchanged.\n     - CVE-2023-44487","modified":"2026-10-26T09:32:04.177639018Z","published":"2026-08-31T11:17:24Z","upstream":["CVE-2020-11080","CVE-2023-35945","CVE-2023-44487"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788175030.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11080"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35945"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487"}],"affected":[{"package":{"name":"libnghttp2-14","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libnghttp2-14?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}},{"package":{"name":"libnghttp2-dev","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libnghttp2-dev?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}},{"package":{"name":"libnghttp2-doc","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/libnghttp2-doc?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}},{"package":{"name":"nghttp2","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/nghttp2?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}},{"package":{"name":"nghttp2-client","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/nghttp2-client?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}},{"package":{"name":"nghttp2-proxy","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/nghttp2-proxy?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}},{"package":{"name":"nghttp2-server","ecosystem":"TuxCare:Ubuntu:18.04","purl":"pkg:deb/tuxcare/nghttp2-server?distro=ubuntu-18.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0-1ubuntu1+tuxcare.els3"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1788175030.json"}}],"schema_version":"1.9.0"}