Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

nghttp2 may crash when handling malformed data

published 6 months ago

Summary

The nghttp2 library, used for HTTP/2 communications, could stop working properly if it receives unexpected data after a termination request. This can cause the program to halt unexpectedly, potentially disrupting services that rely on it. Updating to version 1.68.1 resolves the issue; if you cannot upgrade, consider limiting exposure to malformed traffic.

What to do

Update redhat libnghttp2 to version 0:1.33.0-5.el8_8.2.
Update redhat libnghttp2-debuginfo to version 0:1.33.0-5.el8_8.2.
Update redhat nghttp2 to version 0:1.33.0-5.el8_8.2.
Update redhat nghttp2-debuginfo to version 0:1.33.0-5.el8_8.2.
Update redhat nghttp2-debugsource to version 0:1.33.0-5.el8_8.2.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:8.8::baseos	redhat	libnghttp2	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_e4s:8.8::baseos	redhat	libnghttp2-debuginfo	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_e4s:8.8::baseos	redhat	nghttp2	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_e4s:8.8::baseos	redhat	nghttp2-debuginfo	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_e4s:8.8::baseos	redhat	nghttp2-debugsource	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_tus:8.8::baseos	redhat	libnghttp2	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_tus:8.8::baseos	redhat	libnghttp2-debuginfo	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_tus:8.8::baseos	redhat	nghttp2	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_tus:8.8::baseos	redhat	nghttp2-debuginfo	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2
Red Hat:rhel_tus:8.8::baseos	redhat	nghttp2-debugsource	< 0:1.33.0-5.el8_8.2 Fix: upgrade to 0:1.33.0-5.el8_8.2

Original advisory text

Red Hat Security Advisory: nghttp2 security update

References

https://access.redhat.com/errata/RHSA-2026:8540 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2448754 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8540.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-27135 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-27135 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-27135 Vendor Advisory
https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46... Third Party Advisory
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published17 Apr 2026

Updated30 Apr 2026

First seen30 Apr 2026

Sources

RHSA-2026:8540 · OSV

Track software like this

Free during beta