nghttp21.68.1: assertion fail via FRAME_SIZE_ERROR after session termination
CVE-2026-27135 Published on March 18, 2026

nghttp2 Denial of service: Assertion failure due to the missing state validation
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

NVD

Vulnerability Analysis

CVE-2026-27135 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Weakness Type

What is an assertion failure Vulnerability?

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

CVE-2026-27135 has been classified to as an assertion failure vulnerability or weakness.


Products Associated with CVE-2026-27135

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-27135 are published in these products:

Nghttp2
 
Oracle
 
Red Hat Http Server
 
Red Hat Jboss Core Services
 
Red Hat Openshift
 
Red Hat Rhosemc
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel Eus
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel E4s
 
Red Hat Rhel Tus
 
Red Hat Ai Inference Server
 
Red Hat Discovery
 
Red Hat Hummingbird
 
Red Hat Insights Proxy
 
Red Hat Rhui
 

Affected Versions

nghttp2: Red Hat JBoss Core Services for RHEL 8: Red Hat JBoss Core Services on RHEL 7: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 10.0 Extended Update Support: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8.2 Advanced Update Support: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: Red Hat Enterprise Linux 8.6 Telecommunications Update Service: Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions: Red Hat Enterprise Linux 8.8 Telecommunications Update Service: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.4 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat Enterprise Linux 9.6 Extended Update Support: Red Hat JBoss Core Services 2.4.62.SP4: Red Hat OpenShift Container Platform 4.12: Red Hat OpenShift Container Platform 4.13: Red Hat OpenShift Container Platform 4.14: Red Hat OpenShift Container Platform 4.15: Red Hat OpenShift Container Platform 4.16: Red Hat OpenShift Container Platform 4.17: Red Hat OpenShift Container Platform 4.18: Red Hat OpenShift Container Platform 4.19: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat RHEL-8 based Middleware Containers: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.2: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat AI Inference Server 3.3: Red Hat Discovery 2: Red Hat Discovery 2: Red Hat Hardened Images: Red Hat Insights proxy 1.5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP: Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP:

Exploit Probability

EPSS
0.56%
Percentile
42.14%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.