Critical Security Flaw in libnghttp2: Denial of Service Vulnerability
Summary
ALSA-2026:7668: Important: nghttp2 security update. Affects libnghttp2 versions < 1.43.0-6.el9_7.1. Fixed in 1.43.0-6.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libnghttp2 is a robust library designed for implementing the Hypertext Transfer Protocol version 2 (HTTP/2) in C. It is widely utilized in various applications for efficient data transmission over the web. The library's functionality includes managing HTTP/2 connections, handling streams, and facilitating multiplexing, which allows multiple requests and responses to be sent simultaneously over a single connection. However, it is susceptible to vulnerabilities that can compromise its stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-27135 allows for a Denial of Service (DoS) attack through the exploitation of malformed HTTP/2 frames after a session has been terminated. This flaw can lead to unexpected behavior, causing the application using libnghttp2 to crash or become unresponsive, thereby disrupting service availability. The issue arises from improper handling of specific HTTP/2 frames, which can be triggered by an attacker sending crafted requests.
How To Fix
Minimum fixed version
1.43.0-6.el9_7.1
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement strict input validation to filter out malformed HTTP/2 frames. However, this is not a substitute for upgrading to the patched version of the library.
Conclusion
The vulnerability in libnghttp2, identified as CVE-2026-27135, poses a significant risk of Denial of Service attacks through malformed HTTP/2 frames. It is crucial for users to update to the patched version to ensure the security and stability of their applications. Temporary workarounds can be implemented, but they should not replace the need for an update.
See every vulnerability recorded for libnghttp2 →
FAQ
CVE-2026-27135 is a security vulnerability in libnghttp2 that allows for Denial of Service attacks through malformed HTTP/2 frames.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
Exploiting this vulnerability can lead to application crashes or unresponsiveness, affecting service availability for users.
Yes, a patch is available in version 1.43.0-6.el9_7.1 and later for the affected packages.
If immediate updates are not possible, implement strict input validation as a temporary workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
