CVE-2026-27135: nghttp2 Denial of service: Assertion failure due to the missing state validation

Overview

Severity

High (CVSS 7.5)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Status

Not Exploited

Patch Tuesday

2026-Mar

Released

2026-03-20

Last Updated

2026-03-27

EPSS Score

0.02% (percentile: 6.7%)

Affected Products (9)

Open Source Software

• azl3 nghttp2 1.61.0-2 on Azure Linux 3.0
• azl3 cmake 3.30.3-12 on Azure Linux 3.0
• azl3 nodejs 20.14.0-13 on Azure Linux 3.0
• azl3 rust 1.75.0-25 on Azure Linux 3.0
• azl3 rust 1.90.0-4 on Azure Linux 3.0
• cbl2 cmake 3.21.4-21 on CBL Mariner 2.0
• cbl2 nghttp2 1.57.0-2 on CBL Mariner 2.0
• cbl2 nodejs18 18.20.3-11 on CBL Mariner 2.0
• cbl2 rust 1.72.0-14 on CBL Mariner 2.0

Revision History

• 2026-03-20: Information published.
• 2026-03-21: Information published.
• 2026-03-21: Information published.
• 2026-03-25: Information published.
• 2026-03-27: Information published.