CVE-2026-27135

Name of the Vulnerable Software and Affected Versions nghttp2 versions prior to 1.68.1

Description nghttp2 is a C implementation of the Hypertext Transfer Protocol version 2. Versions of nghttp2 prior to 1.68.1 are susceptible to a denial-of-service condition. This occurs because the library does not properly validate its internal state after the nghttp2 session terminate session or nghttp2 session terminate session2 APIs are called. Consequently, the library continues to process incoming data, and a malformed frame can trigger an assertion failure, leading to a crash. The issue is triggered by receiving a frame that causes a FRAME SIZE ERROR.

Recommendations Update to nghttp2 version 1.68.1 or later.