Junglewise Threat Intelligence

CVE-2026-27135: nghttp2 denial of service via assertion failure in session termination

CVE-2026-27135 · Severity: high · CVSS 7.5 · Published 2026-03-18

Executive brief

nghttp2 is a widely used software library that enables applications to communicate using the HTTP/2 protocol. A vulnerability exists where the library fails to properly stop processing data after a connection error or termination request occurs. An attacker can exploit this by sending specially crafted network traffic to crash the application, leading to a denial-of-service (DoS) condition that disrupts business operations and service availability.

Technical details

A reachable assertion vulnerability (CWE-617) exists in nghttp2 prior to version 1.68.1. The issue stems from missing internal state validation in the `nghttp2_session_mem_recv2` function. When `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called (either by the application or internally due to a connection error), the library may continue reading incoming data instead of stopping. If a subsequent malformed frame is received that triggers a `FRAME_SIZE_ERROR`, the library hits an assertion failure and crashes. This can be triggered remotely without authentication if specific extensions like ALTSVC or PRIORITY_UPDATE are enabled. The vulnerability is resolved in version 1.68.1 by adding the necessary state checks.

Affected products

  • nghttp2 nghttp2 < 1.68.1

Timeline

  • 2026-03-18: advisory: GitHub Security Advisory published
  • 2026-03-18: disclosed
  • 2026-03-18: patched: Fixed in version 1.68.1

References

Related threats