Skip to main content

Nghttp2 CVE-2026-27135

| EUVDEUVD-2026-12919 HIGH
Reachable Assertion (CWE-617)
2026-03-18 GitHub_M
Denial Of Service Nghttp2
7.5
CVSS 3.1 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send HTTP/2 request
  2. Delivery
    Trigger nghttp2_session_terminate_session
  3. Exploit
    Continue reading incoming data
  4. Execution
    Send malformed frame
  5. Persist
    Cause FRAME_SIZE_ERROR
  6. Impact
    Denial of Service

Vulnerability Assessment

Weakness
CWE
CWE-617
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
Exploitation Conditions

Remote unauthenticated attacker sending malformed HTTP/2 frames to nghttp2 library versions prior to 1.68.1. No special configuration required. Exploitation occurs when application calls nghttp2_session_terminate_session() or nghttp2_session_terminate_session2(), then attacker sends FRAME_SIZE_ERROR-inducing frames.
Impact

The CVSS v3.1 score of 7.5 (High) reflects network-based exploitation with low attack complexity, no privileges required, and no user interaction needed (AV:N/AC:L/PR:N/UI:N), resulting in high availability impact (A:H) with no confidentiality or integrity impact. The vulnerability is particularly concerning because it meets multiple high-risk criteria: it is remotely exploitable without authentication, the attack complexity is low, and the technical impact is denial of service affecting application availability. The attack vector is network-based, meaning any exposed nghttp2-based service (web servers, proxies, API gateways) could be targeted. While no EPSS score or KEV inclusion is provided in the intelligence data, the existence of a GitHub Security Advisory (GHSA-6933-cjhr-5qg6) and a specific commit patch (5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1) indicates the vulnerability is publicly disclosed with technical details available. The straightforward nature of the vulnerability (sending malformed frames to trigger assertion failure) suggests it could be easily automated for mass exploitation. Organizations using nghttp2 in internet-facing services should prioritize remediation due to the combination of remote exploitability, lack of authentication requirements, and operational impact.
Exploit ScenarioDerived

An unauthenticated remote attacker identifies an internet-facing web server or API gateway using a vulnerable version of nghttp2 for HTTP/2 support. The attacker crafts a malicious HTTP/2 connection that triggers internal termination conditions (such as sending frames that cause connection errors), then immediately sends a malformed frame designed to trigger FRAME_SIZE_ERROR while the library is in a partially terminated state. Because the library lacks proper state validation and continues processing data, the malformed frame triggers an assertion failure, causing the application to crash and denying service to legitimate users. This attack can be automated and repeated to maintain a persistent denial of service condition.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 18, 2026

nghttp2 before version 1.68.1 fails to properly validate internal state when session termination APIs are invoked, allowing an attacker to send a malformed frame that triggers an assertion failure and crashes the application. This denial of service vulnerability affects applications using the nghttp2 HTTP/2 library and can be triggered remotely without authentication or user interaction. No patch is currently available to remediate this issue.

Earlier versions of this analysis (1)
v1 Mar 18, 2026 - 18:15 CVSS 7.5

A denial-of-service vulnerability exists in the nghttp2 HTTP/2 library that allows remote attackers to crash applications through malformed frames. The vulnerability affects nghttp2 versions prior to 1.68.1 and can be exploited remotely without authentication or user interaction. An attacker can trigger an assertion failure by sending specially crafted HTTP/2 frames after the library enters a termination state, resulting in high availability impact.

RemediationAI

Upgrade nghttp2 to version 1.68.1 or later, which includes the necessary internal state validation fix to prevent assertion failures (see commit https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 and advisory https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6). Organizations should update both direct nghttp2 installations and any bundled versions included in downstream products such as web servers, load balancers, or containerized applications. The advisory explicitly states that no known workarounds are available, making patching the only effective mitigation. Until patching is complete, organizations may consider implementing rate limiting and traffic filtering at the network perimeter to reduce exposure to potential exploitation attempts, though these measures do not eliminate the underlying vulnerability.

Affected VersionsENISA

nghttp2 < 1.68.1

Affected Packages

euvd nghttp2 fix: 1.68.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

nghttp2 is a widely-used C implementation of the HTTP/2 protocol (RFC 7540) that provides both client and server functionality. The affected component is identified as cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:* covering all versions before 1.68.1. The vulnerability is classified as CWE-617 (Reachable Assertion), where the code contains assertions that can be triggered by an attacker, leading to program termination. The root cause stems from missing internal state validation after the nghttp2_session_terminate_session or nghttp2_session_terminate_session2 APIs are called. Despite these termination APIs being invoked (either by the application or internally when detecting connection errors), the library fails to properly validate state and continues processing incoming data. When a malformed frame causing FRAME_SIZE_ERROR is subsequently received, an assertion check fails and crashes the process.

Know when Nghttp2 gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
PoC Detected
Mar 23, 2026 - 17:51 vuln.today
Public exploit code
CVE Published
Mar 18, 2026 - 17:59 nvd
HIGH 7.5

DescriptionCVE.org

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Executive ViewAI

Why It Matters

A remote denial-of-service vulnerability in nghttp2 affects any application using this HTTP/2 library, allowing attackers to crash services without authentication. This poses an immediate availability risk to customer-facing applications and internal services relying on HTTP/2, with no vendor patch currently available.

Business Impact: High
Compensating Controls

Deploy WAF with HTTP/2 frame validation rules; implement connection-level rate limiting and request throttling; enable HTTP/2 connection timeouts; segment critical services behind additional reverse proxies with HTTP/2 inspection; monitor and alert on assertion failures and application crashes; consider temporary disable of HTTP/2 if HTTP/1.1 alternative is viable; apply strict firewall rules limiting HTTP/2 access to trusted sources only.

Threat Intelligence Overview

Threat Score
5.0/10
Composite threat intelligence
EPSS Score
0.0%
Top 98% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Out-of-Cycle
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

68
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in nghttp2 and giflib Buffer/Memory Issues

View all 2
CVE-2026-26740 HIGH POC
8.2

More in Nghttp2

View all
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2024-28182 MEDIUM
5.3 Apr 04

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Rated medium severity (CVSS 5.3), this v
CVE-2015-8659 CRITICAL
10.0 Jan 12

The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a

CVE-2026-58055 MEDIUM POC
6.3 Jun 28

HTTP request/response smuggling in nghttpx (the reverse proxy component of nghttp2 through 1.69.0) allows unauthenticate
CVE-2023-35945 HIGH
7.5 Jul 13

Envoy is a cloud-native high-performance edge/middle/service proxy. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2020-11080 HIGH
7.5 Jun 03

In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. Rated high se
CVE-2018-1000168 HIGH
7.5 May 08

nghttp2 version >= 1.10.0 and nghttp2 <= v1.31.0 contains an Improper Input Validation CWE-20 vulnerability in ALTSVC fr

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2021-27212 HIGH POC
7.5
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Debian

nghttp2
Release Status Fixed Version Urgency
bullseye vulnerable 1.43.0-1+deb11u1 -
bullseye (security) vulnerable 1.43.0-1+deb11u2 -
bookworm vulnerable 1.52.0-1+deb12u2 -
bookworm (security) vulnerable 1.52.0-1+deb12u1 -
trixie vulnerable 1.64.0-1.1 -
forky, sid vulnerable 1.68.0-2 -
(unstable) fixed (unfixed) -

SUSE

Severity: High
Product Status
Container private-registry/harbor-trivy-adapter:1.1.2-2.6 Image SLES15-SP7-SAP-Azure-LI-BYOS-Production Image SLES15-SP7-SAP-Azure-VLI-BYOS-Production Image SLES15-SP7-SAP-EC2 Image pr_15_7 Affected
Container suse/ltss/sle12.5/sles12sp5:8.5.215 Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.150 Container suse/sl-micro/6.0/base-os-container:2.1.3-7.117 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.135 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.149 Container suse/sl-micro/6.0/toolbox:13.2-9.85 Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.80 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.103 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.107 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.94 Image SL-Micro Image SL-Micro-Base Image SL-Micro-Base-RT Image SL-Micro-Base-RT-SelfInstall Image SL-Micro-Base-RT-encrypted Image SL-Micro-Base-SelfInstall Image SL-Micro-Base-encrypted Image SL-Micro-Base-qcow Image SL-Micro-Default Image SL-Micro-Default-SelfInstall Image SL-Micro-Default-encrypted Image SL-Micro-Default-qcow Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Affected
Container suse/sles/16.0/toolbox:16.3-1.38 Image SLES-CHOST-BYOS-EC2 Affected
Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:7080 ADVISORY https://access.redhat.com/errata/RHSA-2026:7123 ADVISORY https://access.redhat.com/errata/RHSA-2026:7302 ADVISORY https://access.redhat.com/errata/RHSA-2026:7310 ADVISORY https://access.redhat.com/errata/RHSA-2026:7350 ADVISORY https://vuldb.com/?id.351592 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1056/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20833/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20870/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20925/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20950/ REF http://www.openwall.com/lists/oss-security/2026/03/20/3 REF https://access.redhat.com/errata/RHSA-2026:10065 REF https://access.redhat.com/errata/RHSA-2026:11768 REF https://access.redhat.com/errata/RHSA-2026:13812 REF https://access.redhat.com/errata/RHSA-2026:14773 REF https://access.redhat.com/errata/RHSA-2026:14937 REF https://access.redhat.com/errata/RHSA-2026:15087 REF https://access.redhat.com/errata/RHSA-2026:16008 REF https://access.redhat.com/errata/RHSA-2026:16009 REF https://access.redhat.com/errata/RHSA-2026:16030 REF https://access.redhat.com/errata/RHSA-2026:16174 REF https://access.redhat.com/errata/RHSA-2026:17596 REF https://access.redhat.com/errata/RHSA-2026:19724 REF https://access.redhat.com/errata/RHSA-2026:19725 REF https://access.redhat.com/errata/RHSA-2026:20040 REF https://access.redhat.com/errata/RHSA-2026:20087 REF https://access.redhat.com/errata/RHSA-2026:21656 REF https://access.redhat.com/errata/RHSA-2026:21690 REF https://access.redhat.com/errata/RHSA-2026:21695 REF https://access.redhat.com/errata/RHSA-2026:25096 REF https://access.redhat.com/errata/RHSA-2026:27200 REF https://access.redhat.com/errata/RHSA-2026:27201 REF https://access.redhat.com/errata/RHSA-2026:6190 REF https://access.redhat.com/errata/RHSA-2026:7666 REF https://access.redhat.com/errata/RHSA-2026:7667 REF https://access.redhat.com/errata/RHSA-2026:7668 REF https://access.redhat.com/errata/RHSA-2026:7670 REF https://access.redhat.com/errata/RHSA-2026:7675 REF https://access.redhat.com/errata/RHSA-2026:7896 REF https://access.redhat.com/errata/RHSA-2026:7983 REF https://access.redhat.com/errata/RHSA-2026:8339 REF https://access.redhat.com/errata/RHSA-2026:8538 REF https://access.redhat.com/errata/RHSA-2026:8539 REF https://access.redhat.com/errata/RHSA-2026:8540 REF https://access.redhat.com/errata/RHSA-2026:8541 REF https://access.redhat.com/errata/RHSA-2026:8545 REF https://access.redhat.com/errata/RHSA-2026:8546 REF https://access.redhat.com/errata/RHSA-2026:8547 REF https://access.redhat.com/errata/RHSA-2026:8548 REF https://access.redhat.com/errata/RHSA-2026:8868 REF https://access.redhat.com/errata/RHSA-2026:9711 REF https://access.redhat.com/errata/RHSA-2026:9832 REF https://access.redhat.com/errata/RHSA-2026:9874 REF https://access.redhat.com/security/cve/CVE-2026-27135 REF https://bugzilla.redhat.com/show_bug.cgi?id=2448754 REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 REF https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 REF https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy