nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.
Conclusion & alert: CVE-2026-27135 is rated Moderate Risk (45.2/100): CVSS High severity, with low exploitation likelihood (EPSS 0.56%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.01% | 0.56% | +0.55% |
| 2 | 2026-03-19 | — | 0.01% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2026-27135: 1 source package rows (nghttp2); 25 state rows across 6 repos (3.19-main, 3.20-main, 3.21-main, 3.22-main, 3.23-main, edge-main); fixed 0, open 25. | https://security.alpinelinux.org/vuln/CVE-2026-27135 |
debian
|
not yet assigned | CVE-2026-27135 not yet assigned priority: Debian including 1 source packages (nghttp2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-27135 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-27135 |
suse
|
high | CVE-2026-27135 severity important: SUSE including 341 source package names (1.1.2-2.6:libnghttp2-14-1.64.0-150700.3.3.1, 13.2-9.85:libnghttp2-14-1.52.0-slfo.1.1_2.1, …), 531 product×package rows across 98 product lines (Container private-registry/harbor-trivy-adapter, Container suse/ltss/sle12.5/sles12sp5, … (98 product lines)): Fixed 242, Known Affected 231, Known Not Affected 55, First Fixed 3. | https://www.suse.com/security/cve/CVE-2026-27135/ |
ubuntu
|
medium | CVE-2026-27135 medium priority: Ubuntu including 1 source packages (nghttp2), 7 status rows across 7 suites (bionic, focal, jammy, noble, questing, upstream, xenial): needs-triage 7. | https://ubuntu.com/security/CVE-2026-27135 |
| URL | Tags |
|---|---|
| https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 | Patch |
| https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/03/20/3 | Mailing List Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2026/05/msg00025.html |