CVE-2026-27135
nghttp2 Denial of service: Assertion failure due to the missing state validation
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
| CWE | CWE-617 |
| Vendor | nghttp2 |
| Product | nghttp2 |
| Published | Mar 18, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for nghttp2 nghttp2
Be the first to know when new high vulnerabilities affecting nghttp2 nghttp2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
nghttp2 / nghttp2
< 1.68.1
References
github.com: https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 github.com: https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 openwall.com: http://www.openwall.com/lists/oss-security/2026/03/20/3 lists.debian.org: https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-27135 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2448754 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27200 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21695 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13812 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21690 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:15087 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14773 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20087 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17596 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21656 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20040 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8868 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7310 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7666 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7080 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7675 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8339 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7123 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7670 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9711 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9874 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7983 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7896 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7302 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7350 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7667 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8541 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8539 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8538 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8540 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8546 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8545 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8547 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8548 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:7668 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25096 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19724 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19725 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16008 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16030 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16009 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:16174 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14937 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6190 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9832 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27201 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11768 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:10065 cert-portal.siemens.com: https://cert-portal.siemens.com/productcert/html/ssa-019113.html