CVE-2026-27135 is a denial of service vulnerability in the nghttp2 library caused by missing internal state validation. After an HTTP/2 session is terminated, the library continues processing incoming data, which can be exploited by a remote attacker sending malformed HTTP/2 frames to trigger an assertion failure and crash the service. The vulnerability is tracked under CWE-617 (Reachable Assertion). Red Hat has identified affected products including Red Hat Hardened Images and related nghttp2 RPMs. The advisory references a specific commit addressing the issue and provides detailed impact and mitigation information. No CVSS score is provided by Red Hat, but the impact is rated high due to the potential for service disruption.

The vulnerability allows remote attackers to cause a denial of service by crashing the affected application through assertion failures triggered by malformed HTTP/2 frames after session termination. There is no impact on confidentiality or integrity, only availability is affected. No known exploits are currently active in the wild. The impact is limited to service disruption.

Red Hat has published an advisory (RHSA-2026:8868) describing the vulnerability and the affected components. Although no explicit patch links are provided in the input data, the advisory references a commit that fixes the issue. Customers should monitor Red Hat's official channels for the release of updated RPM packages containing the fix. Until then, no specific mitigations are described by Red Hat. Users are advised to apply the official fix once available. Red Hat manages remediation for these products and provides support through their Technical Account Manager (TAM) program for further assistance.