--- id: CVE-2026-27135 title: >- nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) summary: >- A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 fram… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-617 vendor: Red Hat product: Red Hat Enterprise Linux AppStream (v. 8) affected: - openshift_container_platform 4 - jboss_core_services_on_rhel_7_server - jboss_core_services_on_rhel 8 - openshift_container_platform 4.12 - middleware_containers_for_openshift - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.15 - openshift_container_platform 4.16 - openshift_container_platform 4.17 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_eus_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_2 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_e4s_v_8_6 - enterprise_linux_baseos_tus_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_0 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_eus_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_4 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 patched: - jboss_core_services_on_rhel_7_server - jboss_core_services_on_rhel 8 - openshift_container_platform 4.12 - middleware_containers_for_openshift - openshift_container_platform 4.13 - openshift_container_platform 4.14 - openshift_container_platform 4.15 - openshift_container_platform 4.16 - openshift_container_platform 4.17 - openshift_container_platform 4.18 - openshift_container_platform 4.19 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_eus_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_eus_v_10_0 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_8 - enterprise_linux_baseos_aus_v_8_2 - enterprise_linux_baseos_aus_v_8_4 - enterprise_linux_baseos_eus_extension_v_8_4 - enterprise_linux_baseos_aus_v_8_6 - enterprise_linux_baseos_e4s_v_8_6 - enterprise_linux_baseos_tus_v_8_6 - enterprise_linux_baseos_e4s_v_8_8 - enterprise_linux_baseos_tus_v_8_8 - enterprise_linux_baseos_e4s_v_9_0 - enterprise_linux_baseos_e4s_v_9_2 - enterprise_linux_baseos_eus_v_9_4 - enterprise_linux_baseos_eus_v_9_6 - enterprise_linux_baseos_v_9 - enterprise_linux_codeready_linux_builder_eus_v_10_0 - enterprise_linux_codeready_linux_builder_v_10 - enterprise_linux_crb_v_8 - codeready_linux_builder_eus_v_9_4 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - ai_inference_server 3.2 published: '2026-03-18' updated: '2026-09-21' sourceUpdated: '2026-09-21T05:28:24+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json - url: 'https://access.redhat.com/security/cve/CVE-2026-27135' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2448754' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-27135' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-27135' - url: >- https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 - url: 'https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6' - url: 'https://access.redhat.com/errata/RHSA-2026:27200' - url: 'https://access.redhat.com/errata/RHSA-2026:21695' - url: 'https://access.redhat.com/errata/RHSA-2026:13812' - url: 'https://access.redhat.com/errata/RHSA-2026:21690' - url: 'https://access.redhat.com/errata/RHSA-2026:15087' - url: 'https://access.redhat.com/errata/RHSA-2026:14773' - url: 'https://access.redhat.com/errata/RHSA-2026:20087' - url: 'https://access.redhat.com/errata/RHSA-2026:17596' - url: 'https://access.redhat.com/errata/RHSA-2026:21656' - url: 'https://access.redhat.com/errata/RHSA-2026:20040' - url: 'https://access.redhat.com/errata/RHSA-2026:8868' - url: 'https://access.redhat.com/errata/RHSA-2026:7310' - url: 'https://access.redhat.com/errata/RHSA-2026:7666' - url: 'https://access.redhat.com/errata/RHSA-2026:7080' - url: 'https://access.redhat.com/errata/RHSA-2026:7675' - url: 'https://access.redhat.com/errata/RHSA-2026:8339' - url: 'https://access.redhat.com/errata/RHSA-2026:7123' - url: 'https://access.redhat.com/errata/RHSA-2026:7670' - url: 'https://access.redhat.com/errata/RHSA-2026:9711' - url: 'https://access.redhat.com/errata/RHSA-2026:9874' - url: 'https://access.redhat.com/errata/RHSA-2026:7983' - url: 'https://access.redhat.com/errata/RHSA-2026:7896' - url: 'https://access.redhat.com/errata/RHSA-2026:7302' tags: - csaf - vex - red-hat - cve.org epss: 0.00892 epssPercentile: 0.57805 ssvc: exploitation: none automatable: 'yes' technicalImpact: partial timestamp: '2026-03-18T18:36:41.841104Z' ingestedAt: '2026-09-08T15:33:26.991Z' --- ## Overview A flaw was found in nghttp2. Due to missing internal state validation, the library continues to process incoming data even after a session has been terminated. A remote attacker could exploit this by sending a specially crafted HTTP/2 frame, leading to an assertion failure and a denial of service (DoS). ## Vendor advisories - **RHSA-2026:27200** · Red Hat · fixed in: Red Hat JBoss Core Services on RHEL 7 Server, Red Hat JBoss Core Services on RHEL 8 · released 2026-06-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:27200) - **RHSA-2026:21695** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.12 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:21695) - **RHSA-2026:13812** · Red Hat · fixed in: Middleware Containers for OpenShift · released 2026-05-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:13812) - **RHSA-2026:21690** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.13 · released 2026-06-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:21690) - **RHSA-2026:15087** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.14 · released 2026-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:15087) - **RHSA-2026:14773** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.15 · released 2026-05-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:14773) - **RHSA-2026:20087** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.16 · released 2026-05-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:20087) - **RHSA-2026:17596** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.17 · released 2026-05-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:17596) - **RHSA-2026:21656** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2026-06-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:21656) - **RHSA-2026:20040** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2026-05-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:20040) - **RHSA-2026:8868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) · released 2026-04-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:8868) - **Red Hat VEX** · Important · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27135.json) **nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination** — rated Important by Red Hat. Released 2026-03-18, updated 2026-09-21. Affected: - Red Hat OpenShift Container Platform 4 Fixed: - Red Hat JBoss Core Services on RHEL 7 Server - Red Hat JBoss Core Services on RHEL 8 - Red Hat OpenShift Container Platform 4.12 - Middleware Containers for OpenShift - Red Hat OpenShift Container Platform 4.13 - Red Hat OpenShift Container Platform 4.14 - Red Hat OpenShift Container Platform 4.15 - Red Hat OpenShift Container Platform 4.16 - Red Hat OpenShift Container Platform 4.17 - Red Hat OpenShift Container Platform 4.18 - Red Hat OpenShift Container Platform 4.19 - Red Hat Enterprise Linux AppStream EUS (v. 10.0) - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream EUS (v.9.4) - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Red Hat Enterprise Linux AppStream (v. 9) - Red Hat Enterprise Linux BaseOS EUS (v. 10.0) - Red Hat Enterprise Linux BaseOS (v. 10) - Red Hat Enterprise Linux BaseOS (v. 8) - Red Hat Enterprise Linux BaseOS AUS (v. 8.2) - Red Hat Enterprise Linux BaseOS AUS (v.8.4) - Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) - Red Hat Enterprise Linux BaseOS AUS (v.8.6) - Red Hat Enterprise Linux BaseOS E4S (v.8.6) - Red Hat Enterprise Linux BaseOS TUS (v.8.6) - Red Hat Enterprise Linux BaseOS E4S (v.8.8) - Red Hat Enterprise Linux BaseOS TUS (v.8.8) - Red Hat Enterprise Linux BaseOS E4S (v.9.0) - Red Hat Enterprise Linux BaseOS E4S (v.9.2) - Red Hat Enterprise Linux BaseOS EUS (v.9.4) - Red Hat Enterprise Linux BaseOS EUS (v.9.6) - Red Hat Enterprise Linux BaseOS (v. 9) - Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) - Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) - Red Hat Enterprise Linux CRB (v. 8) - Red Hat CodeReady Linux Builder EUS (v.9.4) - Red Hat CodeReady Linux Builder EUS (v.9.6) - Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) - Red Hat AI Inference Server 3.2 No fix planned: - Red Hat OpenShift Container Platform 4 Not affected: - Red Hat JBoss Core Services on RHEL 7 Server - Red Hat JBoss Core Services on RHEL 8 - Middleware Containers for OpenShift ## Remediation Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:27200 For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 arc… https://access.redhat.com/errata/RHSA-2026:21695 The RHEL-8 based Middleware Containers container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally. https://access.redhat.com/errata/RHSA-2026:13812