[<prev] [next>] [day] [month] [year] [list]
Message-ID: <e823e8a6-4523-470a-8b4c-78e29d201df4@oracle.com>
Date: Fri, 20 Mar 2026 12:37:09 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: nghttp2 Denial of service: Assertion failure due to
the missing state validation
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6
advises:
>
> Impact
> ------
> nghttp2 library stops reading the incoming data when user facing
> public API nghttp2_session_terminate_session or
> nghttp2_session_terminate_session2 is called by the application.
> They might be called internally by the library when it detects the
> situation that is subject to connection error.
>
> Due to the missing internal state validation, the library keeps
> reading the rest of the data after one of those APIs is called. Then
> receiving a malformed frame that causes FRAME_SIZE_ERROR causes
> assertion failure.
>
> nghttp2_session_terminate_session and
> nghttp2_session_terminate_session2 are used interchangeably in the
> rest of this document.
>
> The detailed execution paths that lead to assertion failure are:
>
> - nghttp2_session_terminate_session is called from
> nghttp2_on_invalid_frame_recv_callback when processing incoming
> ALTSVC (RFC 7838) frame, and then a malformed frame that causes
> FRAME_SIZE_ERROR is received.
>
> - nghttp2_session_terminate_session is called from
> nghttp2_on_frame_recv_callback when processing PRIORITY_UPDATE,
> ALTSVC, or user-defined extension frame, and then a malformed frame
> that causes FRAME_SIZE_ERROR is received.
>
> - nghttp2_session_terminate_session is called from
> nghttp2_on_extension_chunk_recv_callback when processing
> user-defined extension frame, and then a malformed frame that causes
> FRAME_SIZE_ERROR is received.
>
> - nghttp2_session_terminate_session is called from
> nghttp2_unpack_extension_callback when processing user-defined
> extension frame, and then a malformed frame that causes
> FRAME_SIZE_ERROR is received.
>
> - The malformed PRIORITY_UPDATE frame (e.g., stream_id == 0) is
> received, and then a malformed frame that causes FRAME_SIZE_ERROR is
> received.
>
> For PRIORITY_UPDATE and ALTSVC frames, they must be explicitly enabled
> via nghttp2_option_set_builtin_recv_extension_type to be affected.
>
> For user-defined extension frames, they must be explicitly enabled via
> nghttp2_option_set_user_recv_extension_type to be affected.
>
> For the builds that disable assert macro (e.g, -DNDEBUG), it does
> not hit assertion failure, but it might continue reading incoming
> data, which itself does not cause any vulnerability as far as we know.
> We still strongly encourage to apply the patch for those builds as
> well.
>
> The reporter found the cases where ALTSVC is involved. The other
> cases have been investigated and discovered by the nghttp2 development
> team.
>
> Patches
> -------
> nghttp2 v1.68.1 adds missing state validation to avoid assertion
> failure.
>
> Workarounds
> -----------
> There is no workaround.
>
> References
> ----------
> https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1
> fixes this vulnerability.
>
> Severity
> --------
> High
> 7.5 / 10
> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
>
> CVE ID
> ------
> CVE-2026-27135
>
> Credits
> -------
> @AndrewMohawk
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
