CVE catalog

CVE-2026-27135

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Mar 17, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.80% · Oct 25, 2026

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	nghttp2	sid	`1.70.0-1`	fixed
Debian	nghttp2	forky	`1.70.0-1`	fixed
Debian	nghttp2	trixie	`1.64.0-1.1+deb13u1`	fixed
Debian	nghttp2	trixie-security	`1.64.0-1.1+deb13u1`	fixed
Debian	nghttp2	bookworm	`1.52.0-1+deb12u3`	fixed
Debian	nghttp2	bookworm-security	`1.52.0-1+deb12u3`	fixed
Cpe	nghttp2	Not reported	Not reported	vulnerable
Cpe	nghttp2	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	libnghttp2-14	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	libnghttp2-dev	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	libnghttp2-doc	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	nghttp2-client	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	nghttp2-proxy	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	nghttp2-server	Not reported	`1.59.0-1ubuntu0.3`	fixed
Cpe	nghttp2	Not reported	`1.68.1`	fixed
Alpine	nghttp2	3.21	`1.68.1`	fixed
Alpine	nghttp2	3.22	`1.68.1`	fixed
Alpine	nghttp2	3.23	`1.68.1`	fixed
Alpine	nghttp2	3.24	`1.68.1-r0`	fixed
Ubuntu	nghttp2	pro	`1.39.2-1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1build1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.2`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.3`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.3+esm1`	fixed
Ubuntu	nghttp2	22.04	`1.43.0-1`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1build1`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1build2`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1build3`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1ubuntu0.1`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1ubuntu0.2`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1ubuntu0.3`	fixed
Ubuntu	nghttp2	24.04	`1.55.1-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.57.0-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.58.0-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1build1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1build2`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1build4`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1ubuntu0.1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1ubuntu0.2`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1ubuntu0.3`	fixed
Ubuntu	nghttp2	25.10	`1.64.0-1ubuntu1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1build1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1ubuntu1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1ubuntu1.1`	fixed
Ubuntu	nghttp2	26.04	`1.64.0-1.1ubuntu1`	vulnerable
Ubuntu	nghttp2	26.04	`1.64.0-1.1ubuntu2`	vulnerable
Ubuntu	nghttp2	26.04	`1.68.0-1`	vulnerable
Ubuntu	nghttp2	26.04	`1.68.0-2`	vulnerable
Ubuntu	nghttp2	26.04	`1.68.0-2ubuntu0.1`	fixed
Ubuntu	nghttp2	pro	`1.39.2-1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1build1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.1`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.2`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.3`	vulnerable
Ubuntu	nghttp2	pro	`1.40.0-1ubuntu0.3+esm1`	fixed
Ubuntu	nghttp2	22.04	`1.43.0-1`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1build1`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1build2`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1build3`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1ubuntu0.1`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1ubuntu0.2`	vulnerable
Ubuntu	nghttp2	22.04	`1.43.0-1ubuntu0.3`	fixed
Ubuntu	nghttp2	24.04	`1.55.1-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.57.0-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.58.0-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1build1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1build2`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1build4`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1ubuntu0.1`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1ubuntu0.2`	vulnerable
Ubuntu	nghttp2	24.04	`1.59.0-1ubuntu0.3`	fixed
Ubuntu	nghttp2	25.10	`1.64.0-1ubuntu1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1build1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1ubuntu1`	vulnerable
Ubuntu	nghttp2	25.10	`1.64.0-1.1ubuntu1.1`	fixed
Suse	nghttp2	linux enterprise module for basesystem 15 sp7	`1.40.0-150600.25.5.1`	fixed
Suse	nghttp2	linux enterprise server 15 sp6-ltss	`1.40.0-150600.25.5.1`	fixed
Suse	nghttp2	linux enterprise server for sap applications 15 sp6	`1.40.0-150600.25.5.1`	fixed
Opensuse	nghttp2	leap 15.6	`1.40.0-150600.25.5.1`	fixed
Opensuse	nghttp2-python	leap 15.6	`1.40.0-150600.25.5.1`	fixed
Suse	nghttp2	linux enterprise micro 5.3	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise micro 5.4	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise micro 5.5	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15 sp4-espos	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15 sp4-ltss	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15 sp5-espos	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise high performance computing 15 sp5-ltss	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise server 15 sp4-ltss	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise server 15 sp5-ltss	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise server for sap applications 15 sp4	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise server for sap applications 15 sp5	`1.40.0-150200.22.1`	fixed
Suse	nghttp2	linux enterprise micro 5.2	`1.40.0-150200.22.1`	fixed
Suse	cockpit	linux micro 6.0	`309-9.1`	fixed
Suse	nghttp2	linux micro 6.1	`1.52.0-slfo.1.1_2.1`	fixed
Suse	nghttp2	linux enterprise server 16.0	`1.64.0-160000.3.1`	fixed
Suse	nghttp2	linux enterprise server for sap applications 16.0	`1.64.0-160000.3.1`	fixed
Opensuse	nghttp2	leap 16.0	`1.64.0-160000.3.1`	fixed
Suse	nghttp2	linux micro 6.0	`1.52.0-6.1`	fixed
Suse	nghttp2	linux micro 6.2	`1.64.0-160000.3.1`	fixed
Opensuse	nghttp2	tumbleweed	`1.68.1-1.1`	fixed
Suse	nghttp2	linux enterprise module for basesystem 15 sp7	`1.64.0-150700.3.3.1`	fixed
Suse	nghttp2	linux enterprise server 12 sp5-ltss	`1.39.2-3.23.1`	fixed
Suse	nghttp2	linux enterprise server ltss extended security 12 sp5	`1.39.2-3.23.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	nghttp2	source	sid	`1.68.1-1`	not yet assigned	Not reported	[1131369]
Debian	nghttp2	source	forky	`1.68.1-1`	not yet assigned	Not reported	[1131369]
Debian	nghttp2	source	trixie	`1.64.0-1.1+deb13u1`	not yet assigned	Not reported	[1131369]
Debian	nghttp2	source	bookworm	`1.52.0-1+deb12u3`	not yet assigned	Not reported	[1131369]
Cpe	nghttp2	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	libnghttp2-14	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	libnghttp2-dev	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	libnghttp2-doc	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	nghttp2-client	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	nghttp2-proxy	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	nghttp2-server	cpe	Not reported	`1.59.0-1ubuntu0.3`	Not reported	Not reported	Not reported
Cpe	nghttp2	cpe	Not reported	`1.68.1`	Not reported	NVD-CVE-2026-27135	Not reported
Alpine	nghttp2	apk	3.21	`1.68.1`	Not reported	ALPINE-CVE-2026-27135	Not reported
Alpine	nghttp2	apk	3.22	`1.68.1`	Not reported	ALPINE-CVE-2026-27135	Not reported
Alpine	nghttp2	apk	3.23	`1.68.1`	Not reported	ALPINE-CVE-2026-27135	Not reported
Alpine	nghttp2	apk	3.24	`1.68.1-r0`	Not reported	ALPINE-CVE-2026-27135	Not reported
Ubuntu	nghttp2	deb	pro	`1.40.0-1ubuntu0.3+esm1`	Not reported	UBUNTU-CVE-2026-27135	Not reported
Ubuntu	nghttp2	deb	22.04	`1.43.0-1ubuntu0.3`	Not reported	UBUNTU-CVE-2026-27135	Not reported
Ubuntu	nghttp2	deb	24.04	`1.59.0-1ubuntu0.3`	Not reported	UBUNTU-CVE-2026-27135	Not reported
Ubuntu	nghttp2	deb	25.10	`1.64.0-1.1ubuntu1.1`	Not reported	UBUNTU-CVE-2026-27135	Not reported
Ubuntu	nghttp2	deb	26.04	`1.68.0-2ubuntu0.1`	Not reported	UBUNTU-CVE-2026-27135	Not reported
Ubuntu	nghttp2	deb	pro	`1.40.0-1ubuntu0.3+esm1`	Not reported	USN-8233-1	Not reported
Ubuntu	nghttp2	deb	22.04	`1.43.0-1ubuntu0.3`	Not reported	USN-8233-1	Not reported
Ubuntu	nghttp2	deb	24.04	`1.59.0-1ubuntu0.3`	Not reported	USN-8233-1	Not reported
Ubuntu	nghttp2	deb	25.10	`1.64.0-1.1ubuntu1.1`	Not reported	USN-8233-1	Not reported
Suse	nghttp2	rpm	linux enterprise module for basesystem 15 sp7	`1.40.0-150600.25.5.1`	Not reported	SUSE-SU-2026:1350-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 15 sp6-ltss	`1.40.0-150600.25.5.1`	Not reported	SUSE-SU-2026:1350-1	Not reported
Suse	nghttp2	rpm	linux enterprise server for sap applications 15 sp6	`1.40.0-150600.25.5.1`	Not reported	SUSE-SU-2026:1350-1	Not reported
Opensuse	nghttp2	rpm	leap 15.6	`1.40.0-150600.25.5.1`	Not reported	SUSE-SU-2026:1350-1	Not reported
Opensuse	nghttp2-python	rpm	leap 15.6	`1.40.0-150600.25.5.1`	Not reported	SUSE-SU-2026:1350-1	Not reported
Suse	nghttp2	rpm	linux enterprise micro 5.3	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise micro 5.4	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise micro 5.5	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15 sp4-espos	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15 sp4-ltss	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15 sp5-espos	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise high performance computing 15 sp5-ltss	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 15 sp4-ltss	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 15 sp5-ltss	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise server for sap applications 15 sp4	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise server for sap applications 15 sp5	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	nghttp2	rpm	linux enterprise micro 5.2	`1.40.0-150200.22.1`	Not reported	SUSE-SU-2026:1247-1	Not reported
Suse	cockpit	rpm	linux micro 6.0	`309-9.1`	Not reported	SUSE-SU-2026:20950-1	Not reported
Suse	nghttp2	rpm	linux micro 6.1	`1.52.0-slfo.1.1_2.1`	Not reported	SUSE-SU-2026:20950-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 16.0	`1.64.0-160000.3.1`	Not reported	SUSE-SU-2026:20925-1	Not reported
Suse	nghttp2	rpm	linux enterprise server for sap applications 16.0	`1.64.0-160000.3.1`	Not reported	SUSE-SU-2026:20925-1	Not reported
Opensuse	nghttp2	rpm	leap 16.0	`1.64.0-160000.3.1`	Not reported	OPENSUSE-SU-2026:20413-1	Not reported
Suse	nghttp2	rpm	linux micro 6.0	`1.52.0-6.1`	Not reported	SUSE-SU-2026:20870-1	Not reported
Suse	nghttp2	rpm	linux micro 6.2	`1.64.0-160000.3.1`	Not reported	SUSE-SU-2026:20833-1	Not reported
Opensuse	nghttp2	rpm	tumbleweed	`1.68.1-1.1`	Not reported	OPENSUSE-SU-2026:10437-1	Not reported
Suse	nghttp2	rpm	linux enterprise module for basesystem 15 sp7	`1.64.0-150700.3.3.1`	Not reported	SUSE-SU-2026:1074-1	Not reported
Suse	nghttp2	rpm	linux enterprise server 12 sp5-ltss	`1.39.2-3.23.1`	Not reported	SUSE-SU-2026:1056-1	Not reported
Suse	nghttp2	rpm	linux enterprise server ltss extended security 12 sp5	`1.39.2-3.23.1`	Not reported	SUSE-SU-2026:1056-1	Not reported

[Debian bug #1131369]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[libnghttp2-14]Unknown
Source package: [nghttp2]
Details (1)
- 1.70.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.68.1-1.1
  Version impact unknown
  nvd · nghttp2 · opensuse · tumbleweed
[libnghttp2-14-32bit]Unknown
Source package: [nghttp2]
Details (1)
- 1.70.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.68.1-1.1
  Version impact unknown
  nvd · nghttp2 · opensuse · tumbleweed
[libnghttp2-devel]Unknown
Source package: [nghttp2]
Details (1)
- 1.70.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.68.1-1.1
  Version impact unknown
  nvd · nghttp2 · opensuse · tumbleweed
[nghttp2-doc]Unknown
Source package: [nghttp2]
Details (1)
- 1.70.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.68.1-1.1
  Version impact unknown
  nvd · nghttp2 · opensuse · tumbleweed
[nghttp2]Fixed
Source package: [nghttp2]
Details (1)
- 1.70.0-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.68.1-1.1
  nvd · nghttp2 · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libnghttp2-14]Fixed
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
[libnghttp2-dev]Fixed
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
[libnghttp2-doc]Fixed
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
[nghttp2]Fixed
Details (4)
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · all · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · all · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
[nghttp2-client]Fixed
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
[nghttp2-proxy]Fixed
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
[nghttp2-server]Fixed
Source package: [nghttp2]
Details (4)
- 1.52.0-1+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · amd64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm
- 1.52.0-1+deb12u3 · arm64 · bookworm-security
  Fixed · Fixed: 1.52.0-1+deb12u3
  nvd · nghttp2 · debian · bookworm

Observed: Oct 27, 2026, 8:06:40 AM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]