Back Linuxsecurity

Ubuntu LTS USN-4820-1 nginx Moderate Security Patch CVE-2026

Linuxsecurity •LinuxSecurity Advisories • May 13, 2026

CVE-2026-27135 Fix missing iframe->state validations to avoid assertion failure. As backported from upstream v1.68.1 (commit 5c7df8f), incl. upstream test case from commit c619c7be0737ac78051b1cacf4b1ce5467eb838d. For Debian 11 bullseye, this problem has been fixed in version 1.43.0-1+deb11u3. We recommend that you upgrade your nghttp2 packages. For the detailed security status of nghttp2 please refer to its security tracker page at: Further information Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical DoS Vulnerability in nghttp2 Affects Multiple Debian Releases A critical denial-of-service (DoS) vulnerability, CVE-2026-27135, was identified in nghttp2, affecting Debian distributions. The flaw allows attackers to exploit missing iframe state validations, leading to assertion failures. For Debian 11 (bullseye), the issue has been patched in version 1.43.0-1+deb11u3, while Debian 12 (bookworm) and Debian 13 (trixie) have received updates in versions 1.52.0-1+deb12u3 and 1.64.0-1.1+deb13u1, respectively. Users are advised to upgrade their nghttp2 packages to mitigate the risk. The vulnerability was published on March 18, 2026, with a proof of concept (PoC) made public on April 6, 2026. The urgency of the situation is underscored by the critical nature of the flaw and its potential impact on system availability. 2 sources 73

Extracted Entities

Ubuntu LTS USN-4820-1 nginx Moderate Security Patch CVE-2026

The full story

Extracted Entities

Companies (2)

CVEs (1)

Platforms (1)

Tools (1)