CVE-2026-27135VulnerabilityPublished 20 Apr 2026Updated 15 Oct 2026

Red Hat Security Advisory: nghttp2 security update

Affects Red Hat nghttp2Source GCVE Database

Compare

Mentioned vulnerabilities

Not known to be exploited.

Data as of 30 Oct 2026, 11:52 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.8% chance of exploitation in 30 days – higher than 56% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 20 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

bundesamt-f-r-sicherheit-in-de

What to do

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected Red Hat Red Hat Hardened Images aarch64 nghttp2-main@aarch64 Red Hat Enterprise Linux Red Hat Enterprise Linux AppStream (v. 10) Red Hat Enterprise Linux BaseOS (v. 10) Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) Red Hat OpenShift Enterprise Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202605260517-0 Red Hat Enterprise Linux BaseOS (v. 8) Red Hat Enterprise Linux CRB (v. 8) Red Hat Enterprise Linux BaseOS (v. 9) Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) s390x SUSE libnghttp2-14-1.64.0-160000.3.1.aarch64 libnghttp2-devel-1.64.0-160000.3.1.aarch64 nghttp2-1.64.0-160000.3.1.aarch64 libnghttp2-14-0:1.68.1-1.1.aarch64 libnghttp2-14-32bit-0:1.68.1-1.1.aarch64 libnghttp2-devel-0:1.68.1-1.1.aarch64 libnghttp2-0:1.68.1-1.hum1@aarch64 i686 libnghttp2-0:1.43.0-6.el9_6.1.i686 libnghttp2-devel-0:1.43.0-6.el9_6.1.i686 x86_64 Red Hat Enterprise Linux BaseOS E4S (v.8.8) Red Hat Enterprise Linux BaseOS TUS (v.8.8) ppc64le libnghttp2-14-0:1.64.0-160000.3.1.aarch64 libnghttp2-14-0:1.64.0-160000.3.1.ppc64le Red Hat Enterprise Linux AppStream EUS (v. 10.0) Red Hat Enterprise Linux BaseOS EUS (v. 10.0) Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)	Fixed in–

AI-suggested

Red Hat has published an advisory (RHSA-2026:8868) describing the vulnerability and the affected components. Although no explicit patch links are provided in the input data, the advisory references a commit that fixes the issue. Customers should monitor Red Hat's official channels for the release of updated RPM packages containing the fix. Until then, no specific mitigations are described by Red Hat. Users are advised to apply the official fix once available. Red Hat manages remediation for these products and provides support through their Technical Account Manager (TAM) program for further assistance.

Description

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.43. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:21655 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) * sudo: Sudo: Privilege escalation due to failure in privilege drop calls (CVE-2026-35535) * kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-46300) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

Impact

The vulnerability allows remote attackers to cause a denial of service by crashing the affected application through assertion failures triggered by malformed HTTP/2 frames after session termination. There is no impact on confidentiality or integrity, only availability is affected. No known exploits are currently active in the wild. The impact is limited to service disruption.

Summary

CVE-2026-27135 is a denial of service vulnerability in the nghttp2 library caused by missing internal state validation. After an HTTP/2 session is terminated, the library continues processing incoming data, which can be exploited by a remote attacker sending malformed HTTP/2 frames to trigger an assertion failure and crash the service. The vulnerability is tracked under CWE-617 (Reachable Assertion). Red Hat has identified affected products including Red Hat Hardened Images and related nghttp2 RPMs. The advisory references a specific commit addressing the issue and provides detailed impact and mitigation information. No CVSS score is provided by Red Hat, but the impact is rated high due to the potential for service disruption.

CWE-617Reachable Assertion (opens in a new tab)
Base weakness
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Implementation
If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
Implementation
Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
Implementation
Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-272Least Privilege Violation (opens in a new tab)
Base weakness
The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
Architecture and Design · Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
Architecture and Design · Separation of Privilege
Follow the principle of least privilege when assigning access rights to entities in a software system.
Architecture and Design · Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
OWASP Cheat Sheets
Docker Security (opens in a new tab)
OWASP ASVS 4.0.3
V10.2.2 (opens in a new tab)
V1.4.4 (opens in a new tab)
V1.4.5 (opens in a new tab)
Attack patterns
Using Malicious Files (opens in a new tab)
Leverage Executable Code in Non-Executable Files (opens in a new tab)
Manipulating Web Input to File System Calls (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-664Improper Control of a Resource Through its Lifetime (opens in a new tab)
Pillar weakness
The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Attack patterns
Session Credential Falsification through Forging (opens in a new tab)
Reusing Session IDs (aka Session Replay) (opens in a new tab)
Session Fixation (opens in a new tab)
Cross Site Request Forgery (opens in a new tab)
Exploitation of Trusted Identifiers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-123Write-what-where Condition (opens in a new tab)
Base weaknessLikelihood of exploit: High
Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
Operation
Use OS-level preventative functionality integrated after the fact. Not a complete solution.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 16 Aug 2026, 18:08 UTC

WeaknessesCWE-617, CWE-272, CWE-664 +1

Technical details

References

Community reviews

Related threats