RLSA-2026:7667

Synopsis

Important: nghttp2 security update

Description

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 8 aarch64 Rocky Linux 8 x86_64

Fixes

2448754

CVEs

CVE-2026-27135

Affected packages

Rocky Linux 8 aarch64 - BaseOS

libnghttp2-0:1.33.0-6.el8_10.2.aarch64.rpm libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64.rpm nghttp2-0:1.33.0-6.el8_10.2.src.rpm nghttp2-debuginfo-0:1.33.0-6.el8_10.2.aarch64.rpm nghttp2-debugsource-0:1.33.0-6.el8_10.2.aarch64.rpm

Rocky Linux 8 x86_64 - BaseOS

libnghttp2-0:1.33.0-6.el8_10.2.i686.rpm libnghttp2-0:1.33.0-6.el8_10.2.x86_64.rpm libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686.rpm libnghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64.rpm nghttp2-0:1.33.0-6.el8_10.2.src.rpm nghttp2-debuginfo-0:1.33.0-6.el8_10.2.i686.rpm nghttp2-debuginfo-0:1.33.0-6.el8_10.2.x86_64.rpm nghttp2-debugsource-0:1.33.0-6.el8_10.2.i686.rpm nghttp2-debugsource-0:1.33.0-6.el8_10.2.x86_64.rpm

Rocky Linux 8 aarch64 - PowerTools

libnghttp2-devel-0:1.33.0-6.el8_10.2.aarch64.rpm nghttp2-0:1.33.0-6.el8_10.2.aarch64.rpm

Rocky Linux 8 x86_64 - PowerTools

libnghttp2-devel-0:1.33.0-6.el8_10.2.i686.rpm libnghttp2-devel-0:1.33.0-6.el8_10.2.x86_64.rpm nghttp2-0:1.33.0-6.el8_10.2.x86_64.rpm