CLSA-2026-1787303674

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1787303674
Upstream
Published
2026-08-21T09:14:44Z
Modified
2026-10-26T09:31:52Z
Summary
Fix CVE(s): CVE-2026-27135
Details
  • SECURITY UPDATE: assertion failure in nghttp2 HTTP/2 frame processing
    • debian/patches/CVE-2026-27135-1.patch: add missing iframe->state validations in nghttp2_session_mem_recv so that reception stops once the session has been terminated, avoiding an assertion failure on a subsequent malformed frame
    • debian/patches/CVE-2026-27135-2.patch: add the same validation after session_after_header_block_received and after session_process_data_frame, which upstream carries since 1.67.0 and which the fix above therefore does not touch
    • CVE-2026-27135
References

Affected packages

TuxCare:Debian:10
libnghttp2-14

Package

Name
libnghttp2-14
Purl
pkg:deb/tuxcare/libnghttp2-14?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"
libnghttp2-dev

Package

Name
libnghttp2-dev
Purl
pkg:deb/tuxcare/libnghttp2-dev?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"
libnghttp2-doc

Package

Name
libnghttp2-doc
Purl
pkg:deb/tuxcare/libnghttp2-doc?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"
nghttp2

Package

Name
nghttp2
Purl
pkg:deb/tuxcare/nghttp2?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"
nghttp2-client

Package

Name
nghttp2-client
Purl
pkg:deb/tuxcare/nghttp2-client?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"
nghttp2-proxy

Package

Name
nghttp2-proxy
Purl
pkg:deb/tuxcare/nghttp2-proxy?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"
nghttp2-server

Package

Name
nghttp2-server
Purl
pkg:deb/tuxcare/nghttp2-server?distro=debian-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.36.0-2+deb10u3+tuxcare.els2

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"