UbuntuUpdates.org

Package "nghttp2"

Name: nghttp2

Description:

server, proxy and client implementing HTTP/2
Latest version: 1.64.0-1.1ubuntu1.1
Release: questing (25.10)
Level: updates
Repository: universe
Homepage: https://nghttp2.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nghttp2"

All arch deb package
APT INSTALL

Other versions of "nghttp2" in Questing

Repository Area Version
base main 1.64.0-1.1ubuntu1
base universe 1.64.0-1.1ubuntu1
security main 1.64.0-1.1ubuntu1.1
security universe 1.64.0-1.1ubuntu1.1
updates main 1.64.0-1.1ubuntu1.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.64.0-1.1ubuntu1.1 2026-05-05 19:07:50 UTC

  nghttp2 (1.64.0-1.1ubuntu1.1) questing-security; urgency=medium

  * SECURITY UPDATE: Denial of service through assertion failure.
    - debian/patches/CVE-2026-27135-pre1.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - debian/patches/CVE-2026-27135-pre2.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - debian/patches/CVE-2026-27135.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - debian/patches/CVE-2026-27135-post1.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - CVE-2026-27135

 -- Hlib Korzhynskyy <email address hidden> Thu, 23 Apr 2026 16:13:11 -0230
CVE-2026-27135 nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incomi


About   -   Send Feedback to @ubuntu_updates