CVE-2026-27135

## Vulnerability (CVE-2026-27135) The nghttp2 library, an HTTP/2 implementation in C, contains a flaw in its session management logic. When the application calls nghttp2_session_terminate_session or nghttp2_session_terminate_session2—or the library does so internally upon detecting a connection error—data reception should stop. However, due to missing internal state validation, the library continues to read incoming frames after one of these APIs is called. If a subsequent malformed frame causes a FRAME_SIZE_ERROR, an assertion failure occurs [1][3].

Attack

Vector and Exploitation An attacker who can send specially crafted HTTP/2 frames to a vulnerable service may exploit this flaw. The attack does not require authentication but requires the attacker to be able to establish an HTTP/2 connection. Specific paths involve sending frames like ALTSVC, PRIORITY_UPDATE, or user-defined extension frames that trigger the termination API, followed by a malformed frame that provokes the assertion [3]. For built-in extension frames (ALTSVC, PRIORITY_UPDATE) or user-defined extensions, the application must have explicitly enabled them via nghttp2_option_set_builtin_recv_extension_type or nghttp2_option_set_user_recv_extension_type [3]. The vulnerability is present regardless of whether assertions are compiled in; if NDEBUG is defined, the assertion is disabled, but the library still stops processing input correctly, leading to other potential failures [3].

Impact

Successful exploitation causes a denial of service (DoS) by crashing the library via assertion failure. This can terminate the affected HTTP/2 session and potentially the entire service, depending on how the library integrates with the application. The impact is limited to availability; no data confidentiality or integrity is compromised [1][3].

Mitigation

The vulnerability is fixed in nghttp2 version 1.68.1. The patch adds checks for the session state (NGHTTP2_IB_IGN_ALL) at several points in the receive function, ensuring that once termination is signaled, further incoming data is ignored without processing [2]. No workarounds are available; upgrading to the patched version is required [1][3].