CVE-2026-27135: nghttp2 Library DoS Vulnerability

CVE-2026-27135 Overview

CVE-2026-27135 is a denial of service vulnerability in nghttp2, an implementation of the HTTP/2 protocol in C. The vulnerability exists due to missing internal state validation in the nghttp2 library. When the application calls nghttp2_session_terminate_session or nghttp2_session_terminate_session2 APIs to terminate a session, the library fails to properly stop processing incoming data. This allows an attacker to send a malformed frame that triggers a FRAME_SIZE_ERROR, resulting in an assertion failure and application crash.

Critical Impact

Remote attackers can crash applications using vulnerable versions of nghttp2 by sending malformed HTTP/2 frames after session termination is initiated, causing denial of service.

Affected Products

• nghttp2 versions prior to 1.68.1
• Applications and services using vulnerable nghttp2 library builds
• HTTP/2 enabled web servers and proxies utilizing nghttp2

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-27135 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-27135

Vulnerability Analysis

This vulnerability is classified as CWE-617 (Reachable Assertion), a denial of service condition that occurs when an assertion in the code can be triggered by an external input. The flaw resides in the session handling logic within the nghttp2 library.

The core issue stems from the library's behavior when session termination APIs are invoked. When nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called—either by the application directly or internally when a connection error is detected—the library should cease processing incoming data. However, due to missing state validation, the library continues to read and process incoming frames even after termination is requested.

This creates a dangerous window where the library is in an inconsistent state. When a malformed frame with an incorrect size is received during this window, it triggers a FRAME_SIZE_ERROR check that leads to an assertion failure, immediately crashing the application.

Root Cause

The root cause is missing validation of iframe->state when processing frames after session termination. The library fails to check whether the session is in the NGHTTP2_IB_IGN_ALL state (ignore all incoming data) before continuing to process frame data. Without this check, the library attempts to process frames even when it should be ignoring all incoming traffic, leading to the assertion failure when encountering malformed data.

Attack Vector

An attacker can exploit this vulnerability over the network by establishing an HTTP/2 connection to a vulnerable application and triggering conditions that cause session termination. The attack sequence involves:

1. Establishing a valid HTTP/2 connection to the target
2. Sending requests or frames that trigger session termination (either through application logic or by causing a connection error)
3. Immediately following with a malformed frame that has an incorrect frame size
4. The assertion failure crashes the application, causing denial of service

The security patch adds the missing state validation to properly handle this scenario:

          return rv;
        }

+        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+          return (nghttp2_ssize)inlen;
+        }
+
        on_begin_frame_called = 1;

        rv = session_process_headers_frame(session);

Source: GitHub Commit Details

Detection Methods for CVE-2026-27135

Indicators of Compromise

• Application crashes with assertion failure messages in nghttp2 library code
• Abnormal HTTP/2 connection termination patterns followed by additional frame traffic
• Core dump files or crash reports referencing nghttp2_session functions
• Increased rate of FRAME_SIZE_ERROR occurrences in HTTP/2 logs

Detection Strategies

• Monitor application process stability for unexpected crashes in HTTP/2 handling components
• Implement network traffic analysis to detect anomalous HTTP/2 frame sequences following connection errors
• Deploy intrusion detection rules to identify malformed HTTP/2 frames targeting FRAME_SIZE_ERROR conditions
• Review application logs for repeated assertion failures in nghttp2-related code paths

Monitoring Recommendations

• Enable core dump collection and analysis for applications using nghttp2
• Set up process monitoring to alert on unexpected HTTP/2 service restarts
• Configure HTTP/2 connection logging to capture frame-level details for forensic analysis
• Implement rate limiting on HTTP/2 connections to mitigate DoS impact

How to Mitigate CVE-2026-27135

Immediate Actions Required

• Upgrade nghttp2 to version 1.68.1 or later immediately
• Audit all applications and services using nghttp2 library dependencies
• Review and update container images, packages, and deployments that bundle nghttp2
• Implement network-level rate limiting for HTTP/2 connections as a temporary measure

Patch Information

The vulnerability has been addressed in nghttp2 version 1.68.1. The fix adds the missing state validation check to ensure the library properly ignores incoming data when in the NGHTTP2_IB_IGN_ALL state. Organizations should update to this version or later as soon as possible. The security patch details are available in the GitHub Commit Details and the GitHub Security Advisory GHSA-6933.

Workarounds

• No known workarounds are available according to the security advisory
• Upgrading to nghttp2 version 1.68.1 or later is the only effective remediation
• Consider temporarily disabling HTTP/2 support if upgrade is not immediately possible
• Implement additional layers of protection such as web application firewalls with HTTP/2 inspection capabilities

# Verify nghttp2 version and upgrade
nghttp --version
# On Debian/Ubuntu systems
apt-get update && apt-get install --only-upgrade libnghttp2-14
# On RHEL/CentOS systems  
yum update libnghttp2
# Verify updated version
nghttp --version