Ubuntu LTS USN-4820-1 nginx Moderate Security Patch CVE-2026-27136
debian lts
May 13, 2026
A vulnerabilitie was discovered in nghttp2, a server, proxy and client implementing HTTP/2
Topics Covered
Summary
CVE-2026-27135
Fix missing iframe->state validations to avoid assertion failure. As
backported from upstream v1.68.1 (commit 5c7df8f), incl. upstream test case
from commit c619c7be0737ac78051b1cacf4b1ce5467eb838d.
For Debian 11 bullseye, this problem has been fixed in version
1.43.0-1+deb11u3.
We recommend that you upgrade your nghttp2 packages.
For the detailed security status of nghttp2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/nghttp2
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Package: nghttp2
Version: 1.43.0-1+deb11u3
CVE ID: CVE-2026-27135
Debian Bug: 1131369
Topics Covered
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!