Critical Security Update for libnghttp2: Denial of Service Vulnerability
Summary
ALSA-2026:7666: Important: nghttp2 security update. Affects libnghttp2 versions < 1.64.0-2.el10_1.1. Fixed in 1.64.0-2.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libnghttp2 is a C library that implements the Hypertext Transfer Protocol version 2 (HTTP/2). It is widely used for enabling efficient communication between clients and servers over the web. The library supports features such as multiplexing, header compression, and prioritization, which are essential for modern web applications. However, it has been identified that certain malformed HTTP/2 frames can lead to a Denial of Service (DoS) condition after a session has been terminated, making it crucial for users to address this vulnerability promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-27135 allows an attacker to exploit malformed HTTP/2 frames that can cause a Denial of Service after the termination of a session. This can result in service interruptions, making the application unresponsive to legitimate requests. The issue arises from improper handling of HTTP/2 frames, which can lead to resource exhaustion or crashes in applications using the libnghttp2 library.
How To Fix
Minimum fixed version
1.64.0-2.el10_1.1
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement strict input validation to filter out malformed HTTP/2 frames. However, this is not a substitute for applying the security update and should only be used until the update can be applied.
Conclusion
The discovery of CVE-2026-27135 in the libnghttp2 library highlights the importance of maintaining up-to-date software to prevent Denial of Service vulnerabilities. Users are strongly encouraged to apply the necessary updates to ensure the security and reliability of their applications.
See every vulnerability recorded for libnghttp2 →
FAQ
CVE-2026-27135 is a vulnerability in the libnghttp2 library that allows for Denial of Service attacks via malformed HTTP/2 frames after session termination.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability can lead to service outages, making your application unresponsive and potentially affecting user experience.
Yes, Vulert provides a service that monitors and alerts you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
If an immediate update is not possible, implement strict input validation as a temporary workaround until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
