{"id":"CVE-2026-27135","title":"nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)","summary":"A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 fram…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-617","vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["openshift_container_platform 4","jboss_core_services_on_rhel_7_server","jboss_core_services_on_rhel 8","openshift_container_platform 4.12","middleware_containers_for_openshift","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_2","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_eus_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_4","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9"],"patched":["jboss_core_services_on_rhel_7_server","jboss_core_services_on_rhel 8","openshift_container_platform 4.12","middleware_containers_for_openshift","openshift_container_platform 4.13","openshift_container_platform 4.14","openshift_container_platform 4.15","openshift_container_platform 4.16","openshift_container_platform 4.17","openshift_container_platform 4.18","openshift_container_platform 4.19","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_eus_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","enterprise_linux_baseos_eus_v_10_0","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_8","enterprise_linux_baseos_aus_v_8_2","enterprise_linux_baseos_aus_v_8_4","enterprise_linux_baseos_eus_extension_v_8_4","enterprise_linux_baseos_aus_v_8_6","enterprise_linux_baseos_e4s_v_8_6","enterprise_linux_baseos_tus_v_8_6","enterprise_linux_baseos_e4s_v_8_8","enterprise_linux_baseos_tus_v_8_8","enterprise_linux_baseos_e4s_v_9_0","enterprise_linux_baseos_e4s_v_9_2","enterprise_linux_baseos_eus_v_9_4","enterprise_linux_baseos_eus_v_9_6","enterprise_linux_baseos_v_9","enterprise_linux_codeready_linux_builder_eus_v_10_0","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_crb_v_8","codeready_linux_builder_eus_v_9_4","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","ai_inference_server 3.2"],"published":"2026-03-18","updated":"2026-09-21","sourceUpdated":"2026-09-21T05:28:24+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-27135"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448754"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-27135"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135"},{"url":"https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1"},{"url":"https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6"},{"url":"https://access.redhat.com/errata/RHSA-2026:27200"},{"url":"https://access.redhat.com/errata/RHSA-2026:21695"},{"url":"https://access.redhat.com/errata/RHSA-2026:13812"},{"url":"https://access.redhat.com/errata/RHSA-2026:21690"},{"url":"https://access.redhat.com/errata/RHSA-2026:15087"},{"url":"https://access.redhat.com/errata/RHSA-2026:14773"},{"url":"https://access.redhat.com/errata/RHSA-2026:20087"},{"url":"https://access.redhat.com/errata/RHSA-2026:17596"},{"url":"https://access.redhat.com/errata/RHSA-2026:21656"},{"url":"https://access.redhat.com/errata/RHSA-2026:20040"},{"url":"https://access.redhat.com/errata/RHSA-2026:8868"},{"url":"https://access.redhat.com/errata/RHSA-2026:7310"},{"url":"https://access.redhat.com/errata/RHSA-2026:7666"},{"url":"https://access.redhat.com/errata/RHSA-2026:7080"},{"url":"https://access.redhat.com/errata/RHSA-2026:7675"},{"url":"https://access.redhat.com/errata/RHSA-2026:8339"},{"url":"https://access.redhat.com/errata/RHSA-2026:7123"},{"url":"https://access.redhat.com/errata/RHSA-2026:7670"},{"url":"https://access.redhat.com/errata/RHSA-2026:9711"},{"url":"https://access.redhat.com/errata/RHSA-2026:9874"},{"url":"https://access.redhat.com/errata/RHSA-2026:7983"},{"url":"https://access.redhat.com/errata/RHSA-2026:7896"},{"url":"https://access.redhat.com/errata/RHSA-2026:7302"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00775,"epssPercentile":0.54317,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-03-18T18:36:41.841104Z"},"ingestedAt":"2026-09-08T15:33:26.991Z","slug":"CVE-2026-27135","body":"## Overview\n\nA flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:27200** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8 · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27200)\n- **RHSA-2026:21695** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:21695)\n- **RHSA-2026:13812** · Red Hat · fixed in: Middleware Containers for OpenShift · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13812)\n- **RHSA-2026:21690** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:21690)\n- **RHSA-2026:15087** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:15087)\n- **RHSA-2026:14773** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:14773)\n- **RHSA-2026:20087** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-05-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:20087)\n- **RHSA-2026:17596** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:17596)\n- **RHSA-2026:21656** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:21656)\n- **RHSA-2026:20040** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:20040)\n- **RHSA-2026:8868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8868)\n- **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json)\n\n**nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination** — rated Important by Red Hat. Released 2026-03-18, updated 2026-09-21.\n\nAffected:\n\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Red Hat JBoss Core Services on RHEL 7 Server\n- Red Hat JBoss Core Services on RHEL 8\n- Red Hat OpenShift Container Platform 4.12\n- Middleware Containers for OpenShift\n- Red Hat OpenShift Container Platform 4.13\n- Red Hat OpenShift Container Platform 4.14\n- Red Hat OpenShift Container Platform 4.15\n- Red Hat OpenShift Container Platform 4.16\n- Red Hat OpenShift Container Platform 4.17\n- Red Hat OpenShift Container Platform 4.18\n- Red Hat OpenShift Container Platform 4.19\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream EUS (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Enterprise Linux BaseOS EUS (v. 10.0)\n- Red Hat Enterprise Linux BaseOS (v. 10)\n- Red Hat Enterprise Linux BaseOS (v. 8)\n- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.4)\n- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)\n- Red Hat Enterprise Linux BaseOS AUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.6)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.6)\n- Red Hat Enterprise Linux BaseOS E4S (v.8.8)\n- Red Hat Enterprise Linux BaseOS TUS (v.8.8)\n- Red Hat Enterprise Linux BaseOS E4S (v.9.0)\n- Red Hat Enterprise Linux BaseOS E4S (v.9.2)\n- Red Hat Enterprise Linux BaseOS EUS (v.9.4)\n- Red Hat Enterprise Linux BaseOS EUS (v.9.6)\n- Red Hat Enterprise Linux BaseOS (v. 9)\n- Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)\n- Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)\n- Red Hat Enterprise Linux CRB (v. 8)\n- Red Hat CodeReady Linux Builder EUS (v.9.4)\n- Red Hat CodeReady Linux Builder EUS (v.9.6)\n- Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)\n- Red Hat AI Inference Server 3.2\n\nNo fix planned:\n\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat JBoss Core Services on RHEL 7 Server\n- Red Hat JBoss Core Services on RHEL 8\n- Middleware Containers for OpenShift\n\n## Remediation\n\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:27200\nFor OpenShift Container Platform 4.12 see the following documentation,\nwhich will be updated shortly for this release, for important instructions\non how to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes\n\nYou may download the oc tool and use it to inspect release image metadata\nfor x86_64 architecture. The image digest may be found at\nhttps://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\n\n      The sha value for the release is as follows:\n\n      (For x86_64 arc… https://access.redhat.com/errata/RHSA-2026:21695\nThe RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References).\n\nDockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally. https://access.redhat.com/errata/RHSA-2026:13812","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}