Summary
Andrew MacPherson discovered that nghttp2 did not properly validate
internal state when the session termination API was called. A remote
attacker could possibly use this issue to cause nghttp2 to crash, resulting
in a denial of service.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | nghttp2 | 1.43.0-1ubuntu0.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | nghttp2 | 1.59.0-1ubuntu0.3 |
| Ubuntu · 25.10 | nghttp2 | 1.64.0-1.1ubuntu1.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nghttp2 | 1.7.1-1ubuntu0.1~esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nghttp2 | 1.30.0-1ubuntu1+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | nghttp2 | 1.40.0-1ubuntu0.3+esm1 |
References
-
report
https://ubuntu.com/security/CVE-2026-27135