Critical Security Update for libnghttp2: Denial of Service Vulnerability
Summary
ALSA-2026:7667: Important: nghttp2 security update. Affects libnghttp2 versions < 1.33.0-6.el8_10.2. Fixed in 1.33.0-6.el8_10.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libnghttp2 is a C library that implements the Hypertext Transfer Protocol version 2 (HTTP/2). It is widely used for enabling efficient communication between clients and servers over the web. The library supports various features of HTTP/2, such as multiplexing, header compression, and stream prioritization. However, it has been found vulnerable to a Denial of Service (DoS) attack due to malformed HTTP/2 frames being processed after a session has terminated.
Vulnerability Detail
The vulnerability, identified as CVE-2026-27135, allows an attacker to exploit the libnghttp2 library by sending malformed HTTP/2 frames after the termination of a session. This can lead to a Denial of Service condition, where the affected application may crash or become unresponsive, thereby disrupting service availability. The issue arises from improper handling of HTTP/2 frames, which can be triggered by malicious input, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
1.33.0-6.el8_10.2
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the packages is not immediately possible, consider implementing input validation to filter out malformed HTTP/2 frames. However, this is not a substitute for applying the security update.
Conclusion
The libnghttp2 library is critical for HTTP/2 communication, but it is currently vulnerable to a Denial of Service attack due to improper handling of malformed frames. Users are urged to update to the patched version to ensure the security and stability of their applications.
See every vulnerability recorded for libnghttp2 →
FAQ
CVE-2026-27135 is a vulnerability in the libnghttp2 library that allows for Denial of Service attacks via malformed HTTP/2 frames after session termination.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to Denial of Service, causing the application to crash or become unresponsive, which can disrupt services for users.
Yes, the patched version for the affected packages is 1.33.0-6.el8_10.2. It is recommended to update to this version to mitigate the risk.
If immediate updates are not feasible, consider implementing input validation to mitigate the risk of malformed HTTP/2 frames until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
