{"id":"CLSA-2026-1787303674","summary":"Fix CVE(s): CVE-2026-27135","details":"   * SECURITY UPDATE: assertion failure in nghttp2 HTTP/2 frame processing\n     - debian/patches/CVE-2026-27135-1.patch: add missing iframe-\u003estate\n       validations in nghttp2_session_mem_recv so that reception stops once\n       the session has been terminated, avoiding an assertion failure on a\n       subsequent malformed frame\n     - debian/patches/CVE-2026-27135-2.patch: add the same validation after\n       session_after_header_block_received and after\n       session_process_data_frame, which upstream carries since 1.67.0 and\n       which the fix above therefore does not touch\n     - CVE-2026-27135","modified":"2026-10-26T09:31:52.825164304Z","published":"2026-08-21T09:14:44Z","upstream":["CVE-2026-27135"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1787303674.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27135"}],"affected":[{"package":{"name":"libnghttp2-14","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libnghttp2-14?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}},{"package":{"name":"libnghttp2-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libnghttp2-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}},{"package":{"name":"libnghttp2-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libnghttp2-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}},{"package":{"name":"nghttp2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/nghttp2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}},{"package":{"name":"nghttp2-client","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/nghttp2-client?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}},{"package":{"name":"nghttp2-proxy","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/nghttp2-proxy?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}},{"package":{"name":"nghttp2-server","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/nghttp2-server?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.36.0-2+deb10u3+tuxcare.els2"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1787303674.json"}}],"schema_version":"1.9.0"}