What is the CVSS score of CVE-2026-27141?

CVE-2026-27141 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Red Hat are affected by CVE-2026-27141?

CVE-2026-27141 is a denial-of-service vulnerability affecting HTTP/2 servers that can be remotely triggered without authentication, causing service crashes and unavailability.. A patch is available.

How to fix or mitigate CVE-2026-27141?

Within 24 hours: Inventory all systems running HTTP/2 and confirm vulnerability exposure; enable enhanced monitoring for HTTP/2 frame anomalies. Within 7 days: Deploy WAF rules to block malformed HTTP/2 frames (0x0a-0x0f types); consider disabling HTTP/2 if not business-critical. Within 30 days: Monitor vendor security advisories for patch availability; conduct impact assessment for patch deployment; implement patch immediately upon release.

Red Hat CVE-2026-27141

HIGH

NULL Pointer Dereference (CWE-476)

2026-02-26 security@golang.org

Denial Of Service Red Hat Suse

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Red Hat

5.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Feb 26, 2026 - 20:31 nvd

HIGH 7.5

DescriptionCVE.org

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

AnalysisAI

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-476 (NULL Pointer Dereference). Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

Affected ProductsAI

Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Same weakness CWE-476 – NULL Pointer Dereference

View all

CVE-2016-0742 HIGH

7.5

CVE-2014-3470 MEDIUM

4.3

CVE-2017-3730 HIGH POC

7.5

CVE-2017-3169 CRITICAL POC

9.8

CVE-2016-4957 HIGH

7.5

CVE-2015-3194 HIGH

7.5

CVE-2026-21525 MEDIUM

6.2

CVE-2017-0016 MEDIUM

5.9

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 12	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7	Fixed

CVE-2026-27141 vulnerability details – vuln.today

Back

Red Hat CVE-2026-27141

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

Affected ProductsAI

RemediationAI

Same weakness CWE-476 – NULL Pointer Dereference

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code