7.5

CVE-2026-27135: nghttp2 Denial of service: Assertion failure due to the missing state validation

Modified
AliasesALPINE-CVE-2026-27135MGASA-2026-0199SUSE-SU-2026:1056-1
Published 18-03-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-27135 is a high (CVSS 7.5) Reachable Assertion vulnerability in nghttp2. EPSS estimates a 0.80% chance of exploitation in the next 30 days, higher than 56.8% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.80%
0%100%
Low · -0.09 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 15
OPENSUSE-SU-2026:11121-1OPENSUSE-SU-2026:21058-1OPENSUSE-SU-2026:21236-1RHSA-2026:27200RHSA-2026:7080RHSA-2026:7123

Timeline

  1. 18-03-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

0.80%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

Decrease -0.09 pp

From 0.89% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse23 products
  • cockpit&distro=SUSE Linux Micro 6.0< 309-9.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 1.40.0-150200.22.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 1.40.0-150200.22.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS< 1.40.0-150200.22.1
  • nghttp2&distro=SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS< 1.40.0-150200.22.1
Redhat8 products
  • libnghttp2< 0:1.68.1-1.hum1 | < 0:1.64.0-2.el10_1.1 | < 0:1.33.0-6.el8_10.2 | < 0:1.43.0-6.el9_7.1 | < 0:1.69.0-6.1.hum1 | < 0:1.33.0-4.el8_6.3 | < 0:1.33.0-4.el8_4.3 | < 0:1.33.0-5.el8_8.2 | < 0:1.33.0-3.el8_2.4 | < 0:1.43.0-5.el9_2.4 | < 0:1.43.0-5.el9_0.4 | < 0:1.43.0-5.el9_4.4 | < 0:1.43.0-6.el9_6.1 | < 0:1.64.0-2.el10_0.1
  • libnghttp2-debuginfo< 0:1.64.0-2.el10_1.1 | < 0:1.33.0-6.el8_10.2 | < 0:1.43.0-6.el9_7.1 | < 0:1.33.0-4.el8_6.3 | < 0:1.33.0-4.el8_4.3 | < 0:1.33.0-5.el8_8.2 | < 0:1.33.0-3.el8_2.4 | < 0:1.43.0-5.el9_2.4 | < 0:1.43.0-5.el9_0.4 | < 0:1.43.0-5.el9_4.4 | < 0:1.43.0-6.el9_6.1 | < 0:1.64.0-2.el10_0.1
  • libnghttp2-devel< 0:1.68.1-1.hum1 | < 0:1.64.0-2.el10_1.1 | < 0:1.33.0-6.el8_10.2 | < 0:1.43.0-6.el9_7.1 | < 0:1.69.0-6.1.hum1 | < 0:1.43.0-5.el9_4.4 | < 0:1.43.0-6.el9_6.1 | < 0:1.64.0-2.el10_0.1
  • mingw32-libnghttp2< 0:1.68.1-1.hum1 | < 0:1.69.0-6.1.hum1
  • mingw64-libnghttp2< 0:1.68.1-1.hum1 | < 0:1.69.0-6.1.hum1
Opensuse4 products
  • nghttp2-python&distro=openSUSE Leap 15.6< 1.40.0-150600.25.5.1
  • nghttp2&distro=openSUSE Leap 15.6< 1.40.0-150600.25.5.1
  • nghttp2&distro=openSUSE Leap 16.0< 1.64.0-160000.3.1
  • nghttp2&distro=openSUSE Tumbleweed< 1.68.1-1.1
Alpine1 product
  • nghttp2< 1.68.1 | < 1.68.1-r0
Debian1 product
  • nghttp2< 1.52.0-1+deb12u3 | < 1.64.0-1.1+deb13u1 | < 1.68.1-1
Mageia1 product
  • nghttp2< 1.61.0-1.1.mga9
Nghttp21 product
Ubuntu1 product
  • nghttp2< 1.7.1-1ubuntu0.1~esm3 | < 1.30.0-1ubuntu1+esm3 | < 1.40.0-1ubuntu0.3+esm1 | < 1.43.0-1ubuntu0.3 | < 1.59.0-1ubuntu0.3 | < 1.64.0-1.1ubuntu1.1 | < 1.68.0-2ubuntu0.1

8 vendors · 40 products

References

95 links
Show all 95 references