$ cve CVE-2015-8659 JSON

CVE-2015-8659

10.0

CRITICAL · CVSS 3.0 · EPSS 4% (pctl 90)

In your normal cycle

Critical by CVSS (10), but no sign of active exploitation.

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.

CVSS	10.0 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	3.96% — more likely to be exploited than 90% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	none known
Published	2016-01-12
Last modified	2026-06-17