{"schema_version":"1.7.5","id":"CVE-2026-27135","published":"2026-03-18T17:59:02.045Z","modified":"2026-07-22T03:22:02.564642Z","aliases":["GHSA-6933-cjhr-5qg6"],"related":["ALSA-2026:7080","ALSA-2026:7123","ALSA-2026:7350","ALSA-2026:7666","ALSA-2026:7667","ALSA-2026:7668","ALSA-2026:7670","ALSA-2026:7675","ALSA-2026:7896","ALSA-2026:8339","SUSE-SU-2026:1056-1","SUSE-SU-2026:1074-1","SUSE-SU-2026:1247-1","SUSE-SU-2026:1350-1","SUSE-SU-2026:20833-1","SUSE-SU-2026:20870-1","SUSE-SU-2026:20925-1","SUSE-SU-2026:20950-1","SUSE-SU-2026:22368-1","SUSE-SU-2026:22565-1","SUSE-SU-2026:2633-1","SUSE-SU-2026:2647-1","SUSE-SU-2026:2695-1","openSUSE-SU-2026:10437-1","openSUSE-SU-2026:11121-1","openSUSE-SU-2026:20413-1","openSUSE-SU-2026:21058-1","openSUSE-SU-2026:21236-1"],"summary":"nghttp2 Denial of service: Assertion failure due to the missing state validation","details":"nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/nghttp2/nghttp2","events":[{"introduced":"0"},{"fixed":"f769990597670f3ea8d2440d1e18a3f9a0df9bc0"},{"fixed":"5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"}],"database_specific":{"cpe":"cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.68.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.68.0","v1.67.0","v1.66.0","v1.65.0","v1.64.0","v1.63.0","v1.62.0","v1.61.0","v1.60.0","v1.59.0","v1.58.0","v1.57.0","v1.56.0","v1.55.0","v1.54.0","v1.53.0","v1.52.0","v1.51.0","v1.50.0","v1.49.0","v1.48.0","v1.47.0","v1.46.0","v1.45.0","v1.44.0","v1.43.0","v1.42.0","v1.41.0","v1.40.0","v1.39.0","v1.38.0","v1.37.0","v1.36.0","v1.35.0","v1.34.0","v1.33.0","v1.32.0","v1.31.0","v1.30.0","v1.29.0","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.0","v1.22.0","v1.21.0","v1.20.0","v1.19.0","v1.18.0","v1.17.0","v1.16.0","v1.15.0","v1.14.0","v1.13.0","v1.12.0","v1.11.0","v1.10.0","v1.9.1","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.1","v1.2.0","v1.1.2","v1.1.1","v1.1.0","v1.0.5","v1.0.4","v1.0.3","v1.0.2","v1.0.1","v1.0.0","v0.7.15","v0.7.14","v0.7.13","v0.7.12","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.5.1","v0.5.0","v0.4.1","v0.4.0","v0.3.1","v0.3.0","v0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27135.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"91974464785336575161237124874598405546","length":29336},"id":"CVE-2026-27135-052e96b7","signature_type":"Function","signature_version":"v1","source":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","target":{"file":"lib/nghttp2_session.c","function":"nghttp2_session_mem_recv2"}},{"deprecated":false,"digest":{"line_hashes":["202949042875881347632495992968844506076","160741837595040371927561713678830211493","335677869457012927666564322478839596966","61449821073372385805093192648363130489","238786166823349620259567303671146827051","255176408379171195071481573281860700044","53269493975263036937840712408954927514","34270640211144051192282795630062621323","47533979413461081486960454443057498856","151158692563102232309215598025020612317","83538161664035913155579522568897925412","67015599182278403370168776165845497837","191728775405029833150331337944637969184","80459963497393253035256037281387038767","34092721988552067898946513748811728853","148616550735988841864926257506539941842","77237445448959656237761781011833882531","299415230393969611571223267177049552945","38297438882187741157285693641617674032","25218853885416313983383343244048874780","34270640211144051192282795630062621323","47533979413461081486960454443057498856","279275275683330448688090401748582672125","34270640211144051192282795630062621323","47533979413461081486960454443057498856","303651179573578602557652682124023557758"],"threshold":0.9},"id":"CVE-2026-27135-c45a124b","signature_type":"Line","signature_version":"v1","source":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1","target":{"file":"lib/nghttp2_session.c"}}],"vanir_signatures_modified":"2026-07-22T03:22:02Z"}}],"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/03/20/3"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10065"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11768"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13812"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14773"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14937"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:15087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16030"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16174"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17596"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19724"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19725"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20040"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20087"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21656"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21690"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21695"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25096"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27200"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27201"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:6190"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7302"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7350"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7666"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7667"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7668"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7896"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8339"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8538"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8539"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8540"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8541"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8546"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8547"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8548"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8868"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9711"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9832"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9874"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-27135"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27135.json"},{"type":"ADVISORY","url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754"},{"type":"FIX","url":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-617"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27135.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}