Vulnerability-Lookup

MSRC_CVE-2026-27135

Vulnerability from csaf_microsoft - Published: 2026-03-02 00:00 - Updated: 2026-03-27 01:41

Summary

nghttp2 Denial of service: Assertion failure due to the missing state validation

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-27135

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-617 - Reachable Assertion

Vendor Fix 1.61.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

Vendor Fix 3.30.3-13:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

Vendor Fix 20.14.0-14:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

Vendor Fix 3.21.4-23:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

Vendor Fix 1.57.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

Vendor Fix 18.20.3-12:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade https://learn.microsoft.com/en-us/azure/azure-lin…

References

URL

Category

	https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
	https://support.microsoft.com/lifecycle	external
	https://www.first.org/cvss	external
	https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27135.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "nghttp2 Denial of service: Assertion failure due to the missing state validation",
    "tracking": {
      "current_release_date": "2026-03-27T01:41:20.000Z",
      "generator": {
        "date": "2026-03-27T07:08:42.915Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-27135",
      "initial_release_date": "2026-03-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-20T01:02:06.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-03-21T01:02:12.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-03-21T01:37:11.000Z",
          "legacy_version": "3",
          "number": "3",
          "summary": "Information published."
        },
        {
          "date": "2026-03-25T14:36:49.000Z",
          "legacy_version": "4",
          "number": "4",
          "summary": "Information published."
        },
        {
          "date": "2026-03-27T01:41:20.000Z",
          "legacy_version": "5",
          "number": "5",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "5"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 nghttp2 1.61.0-2",
                "product": {
                  "name": "\u003cazl3 nghttp2 1.61.0-2",
                  "product_id": "8"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 nghttp2 1.61.0-2",
                "product": {
                  "name": "azl3 nghttp2 1.61.0-2",
                  "product_id": "20318"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 nghttp2 1.57.0-2",
                "product": {
                  "name": "\u003ccbl2 nghttp2 1.57.0-2",
                  "product_id": "9"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 nghttp2 1.57.0-2",
                "product": {
                  "name": "cbl2 nghttp2 1.57.0-2",
                  "product_id": "19774"
                }
              }
            ],
            "category": "product_name",
            "name": "nghttp2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 cmake 3.30.3-12",
                "product": {
                  "name": "\u003cazl3 cmake 3.30.3-12",
                  "product_id": "1"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 cmake 3.30.3-12",
                "product": {
                  "name": "azl3 cmake 3.30.3-12",
                  "product_id": "20974"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 cmake 3.21.4-21",
                "product": {
                  "name": "\u003ccbl2 cmake 3.21.4-21",
                  "product_id": "6"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 cmake 3.21.4-21",
                "product": {
                  "name": "cbl2 cmake 3.21.4-21",
                  "product_id": "20870"
                }
              }
            ],
            "category": "product_name",
            "name": "cmake"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 nodejs 20.14.0-13",
                "product": {
                  "name": "\u003cazl3 nodejs 20.14.0-13",
                  "product_id": "7"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 nodejs 20.14.0-13",
                "product": {
                  "name": "azl3 nodejs 20.14.0-13",
                  "product_id": "20866"
                }
              }
            ],
            "category": "product_name",
            "name": "nodejs"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003ccbl2 nodejs18 18.20.3-11",
                "product": {
                  "name": "\u003ccbl2 nodejs18 18.20.3-11",
                  "product_id": "5"
                }
              },
              {
                "category": "product_version",
                "name": "cbl2 nodejs18 18.20.3-11",
                "product": {
                  "name": "cbl2 nodejs18 18.20.3-11",
                  "product_id": "20894"
                }
              }
            ],
            "category": "product_name",
            "name": "nodejs18"
          },
          {
            "category": "product_name",
            "name": "azl3 rust 1.75.0-25",
            "product": {
              "name": "azl3 rust 1.75.0-25",
              "product_id": "3"
            }
          },
          {
            "category": "product_name",
            "name": "azl3 rust 1.90.0-4",
            "product": {
              "name": "azl3 rust 1.90.0-4",
              "product_id": "2"
            }
          },
          {
            "category": "product_name",
            "name": "cbl2 rust 1.72.0-14",
            "product": {
              "name": "cbl2 rust 1.72.0-14",
              "product_id": "4"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 nghttp2 1.61.0-2 as a component of Azure Linux 3.0",
          "product_id": "17084-8"
        },
        "product_reference": "8",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nghttp2 1.61.0-2 as a component of Azure Linux 3.0",
          "product_id": "20318-17084"
        },
        "product_reference": "20318",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 cmake 3.30.3-12 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 cmake 3.30.3-12 as a component of Azure Linux 3.0",
          "product_id": "20974-17084"
        },
        "product_reference": "20974",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 nodejs 20.14.0-13 as a component of Azure Linux 3.0",
          "product_id": "17084-7"
        },
        "product_reference": "7",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 nodejs 20.14.0-13 as a component of Azure Linux 3.0",
          "product_id": "20866-17084"
        },
        "product_reference": "20866",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 1.75.0-25 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 rust 1.90.0-4 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 cmake 3.21.4-21 as a component of CBL Mariner 2.0",
          "product_id": "17086-6"
        },
        "product_reference": "6",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 cmake 3.21.4-21 as a component of CBL Mariner 2.0",
          "product_id": "20870-17086"
        },
        "product_reference": "20870",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 nghttp2 1.57.0-2 as a component of CBL Mariner 2.0",
          "product_id": "17086-9"
        },
        "product_reference": "9",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 nghttp2 1.57.0-2 as a component of CBL Mariner 2.0",
          "product_id": "19774-17086"
        },
        "product_reference": "19774",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003ccbl2 nodejs18 18.20.3-11 as a component of CBL Mariner 2.0",
          "product_id": "17086-5"
        },
        "product_reference": "5",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 nodejs18 18.20.3-11 as a component of CBL Mariner 2.0",
          "product_id": "20894-17086"
        },
        "product_reference": "20894",
        "relates_to_product_reference": "17086"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 rust 1.72.0-14 as a component of CBL Mariner 2.0",
          "product_id": "17086-4"
        },
        "product_reference": "4",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-27135",
      "cwe": {
        "id": "CWE-617",
        "name": "Reachable Assertion"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17084-3",
            "17084-2",
            "17086-4"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "GitHub_M",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "20318-17084",
          "20974-17084",
          "20866-17084",
          "20870-17086",
          "19774-17086",
          "20894-17086"
        ],
        "known_affected": [
          "17084-8",
          "17084-1",
          "17084-7",
          "17086-6",
          "17086-9",
          "17086-5"
        ],
        "known_not_affected": [
          "17084-3",
          "17084-2",
          "17086-4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-27135 nghttp2 Denial of service: Assertion failure due to the missing state validation - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27135.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "1.61.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-8"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "3.30.3-13:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "20.14.0-14:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-7"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "3.21.4-23:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-6"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "1.57.0-3:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-9"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        },
        {
          "category": "vendor_fix",
          "date": "2026-03-20T01:02:06.000Z",
          "details": "18.20.3-12:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17086-5"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalsScore": 0.0,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 7.5,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "17084-8",
            "17084-1",
            "17084-7",
            "17086-6",
            "17086-9",
            "17086-5"
          ]
        }
      ],
      "title": "nghttp2 Denial of service: Assertion failure due to the missing state validation"
    }
  ]
}

CVE-2026-27135 (GCVE-0-2026-27135)

Vulnerability from cvelistv5 – Published: 2026-03-18 17:59 – Updated: 2026-03-20 21:07

Title

nghttp2 Denial of service: Assertion failure due to the missing state validation

Summary

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-617 - Reachable Assertion

Assigner

GitHub_M

References

URL

	Vendor	Product	Version
	nghttp2	nghttp2	Affected: < 1.68.1

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

MSRC_CVE-2026-27135

CVE-2026-27135 (GCVE-0-2026-27135)

Tags

Sightings

Nomenclature