Critical Denial of Service Vulnerability in nghttp2 Package
Summary
RLSA-2026:7666: Important: nghttp2 security update. Affects nghttp2 versions < 0:1.64.0-2.el10_1.1. Fixed in 0:1.64.0-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nghttp2 is a widely used library that implements the Hypertext Transfer Protocol version 2 (HTTP/2) in C. It is designed to facilitate efficient communication between clients and servers, supporting features like multiplexing and header compression. However, it is susceptible to vulnerabilities that can compromise its functionality and the applications that depend on it.
Vulnerability Detail
The vulnerability identified as CVE-2026-27135 allows for a Denial of Service (DoS) attack through malformed HTTP/2 frames after a session has been terminated. This means that an attacker can exploit this flaw to disrupt service availability, potentially leading to significant downtime and affecting user experience. The technical aspect of this vulnerability lies in the improper handling of HTTP/2 frames, which can be manipulated to cause the library to crash or become unresponsive.
How To Fix
Minimum fixed version
0:1.64.0-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update nghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of their applications by implementing strict input validation for HTTP/2 frames and monitoring for unusual traffic patterns that may indicate an attempted exploit.
Conclusion
The nghttp2 library is critical for HTTP/2 communication, but it is vulnerable to a Denial of Service attack due to improper handling of HTTP/2 frames. Users are strongly advised to update to the latest version to protect their applications from potential disruptions.
See every vulnerability recorded for nghttp2 →
FAQ
CVE-2026-27135 is a vulnerability in the nghttp2 library that allows for Denial of Service attacks through malformed HTTP/2 frames.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to service disruptions, causing applications to crash or become unresponsive, which can affect user experience and operational efficiency.
Yes, a patched version of nghttp2 is available. Users should update to version 1.64.0-2.el10_1.1 or later to mitigate the risk.
The CVSS score for this vulnerability is 7.5, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for nghttp2.
