nghttp2 up to 1.68.0 HTTP/2 nghttp2_session_terminate_session assertion

Summaryinfo

A vulnerability labeled as problematic has been found in nghttp2 up to 1.68.0. Affected is the function nghttp2_session_terminate_session of the component HTTP2 Handler. Executing a manipulation can lead to assertion. This vulnerability is tracked as CVE-2026-27135. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in nghttp2 up to 1.68.0. It has been declared as problematic. This vulnerability affects the function nghttp2_session_terminate_session of the component HTTP2 Handler. The manipulation with an unknown input leads to a assertion vulnerability. The CWE definition for the vulnerability is CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. As an impact it is known to affect availability. CVE summarizes:

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-27135 since 02/17/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 304232 (openSUSE 16 Security Update : nghttp2 (openSUSE-SU-2026:20413-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.68.1 eliminates this vulnerability. Applying the patch 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (304232), EUVD (EUVD-2026-12919) and CERT Bund (WID-SEC-2026-0775). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Google Container-Optimized OS
• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• RESF Rocky Linux
• Open Source nghttp2

Productinfo

Name

• nghttp2

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36
• 1.37
• 1.38
• 1.39
• 1.40
• 1.41
• 1.42
• 1.43
• 1.44
• 1.45
• 1.46
• 1.47
• 1.48
• 1.49
• 1.50
• 1.51
• 1.52
• 1.53
• 1.54
• 1.55
• 1.56
• 1.57
• 1.58
• 1.59
• 1.60
• 1.61
• 1.62
• 1.63
• 1.64
• 1.65
• 1.66
• 1.67
• 1.68.0

License

• open-source

Website

• Product: https://github.com/nghttp2/nghttp2/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion