Skip to main content

Nghttp2 CVE-2026-27135

| EUVDEUVD-2026-12919 HIGH
Reachable Assertion (CWE-617)
2026-03-18 GitHub_M
Denial Of Service Nghttp2
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Mar 23, 2026 - 17:51 vuln.today
Public exploit code
EUVD ID Assigned
Mar 18, 2026 - 18:15 euvd
EUVD-2026-12919
Analysis Generated
Mar 18, 2026 - 18:15 vuln.today
CVE Published
Mar 18, 2026 - 17:59 nvd
HIGH 7.5

DescriptionCVE.org

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

AnalysisAI

nghttp2 before version 1.68.1 fails to properly validate internal state when session termination APIs are invoked, allowing an attacker to send a malformed frame that triggers an assertion failure and crashes the application. This denial of service vulnerability affects applications using the nghttp2 HTTP/2 library and can be triggered remotely without authentication or user interaction. No patch is currently available to remediate this issue.

Technical ContextAI

nghttp2 is a widely-used C implementation of the HTTP/2 protocol (RFC 7540) that provides both client and server functionality. The affected component is identified as cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:* covering all versions before 1.68.1. The vulnerability is classified as CWE-617 (Reachable Assertion), where the code contains assertions that can be triggered by an attacker, leading to program termination. The root cause stems from missing internal state validation after the nghttp2_session_terminate_session or nghttp2_session_terminate_session2 APIs are called. Despite these termination APIs being invoked (either by the application or internally when detecting connection errors), the library fails to properly validate state and continues processing incoming data. When a malformed frame causing FRAME_SIZE_ERROR is subsequently received, an assertion check fails and crashes the process.

RemediationAI

Upgrade nghttp2 to version 1.68.1 or later, which includes the necessary internal state validation fix to prevent assertion failures (see commit https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 and advisory https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6). Organizations should update both direct nghttp2 installations and any bundled versions included in downstream products such as web servers, load balancers, or containerized applications. The advisory explicitly states that no known workarounds are available, making patching the only effective mitigation. Until patching is complete, organizations may consider implementing rate limiting and traffic filtering at the network perimeter to reduce exposure to potential exploitation attempts, though these measures do not eliminate the underlying vulnerability.

More in Nghttp2

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2015-8659 CRITICAL
10.0 Jan 12

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a

CVE-2026-58055 MEDIUM POC
6.3 Jun 28

HTTP request/response smuggling in nghttpx (the reverse proxy component of nghttp2 through 1.69.0) allows unauthenticate
CVE-2023-35945 HIGH
7.5 Jul 13

Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2020-11080 HIGH
7.5 Jun 03

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. Rated high se
CVE-2018-1000168 HIGH
7.5 May 08

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC fr
CVE-2024-28182 MEDIUM
5.3 Apr 04

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Rated medium severity (CVSS 5.3), this v

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

nghttp2
Release Status Fixed Version Urgency
bullseye vulnerable 1.43.0-1+deb11u1 -
bullseye (security) vulnerable 1.43.0-1+deb11u2 -
bookworm vulnerable 1.52.0-1+deb12u2 -
bookworm (security) vulnerable 1.52.0-1+deb12u1 -
trixie vulnerable 1.64.0-1.1 -
forky, sid vulnerable 1.68.0-2 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Container private-registry/harbor-trivy-adapter:1.1.2-2.6 Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-EC2 Image pr_15_7 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.215 Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.150 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.117 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.135 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.149 Container suse/sl-micro/6.0/toolbox:13.2-9.85 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.80 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.103 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.107 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.94 Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Affected
Container suse/sles/16.0/toolbox:16.3-1.38 Image SLES-CHOST-BYOS-EC2 Affected
Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Share

CVE-2026-27135 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy