Skip to content

Commit 98b359e

Browse files
azurelinux-securityakhila-guruju
azurelinux-security
and
akhila-guruju
authored
[AutoPR- Security] Patch nghttp2 for CVE-2026-27135 [HIGH] (#16247)
Co-authored-by: akhila-guruju <v-guakhila@microsoft.com>
1 parent 1056e3e commit 98b359e

File tree

6 files changed

+130
-9
lines changed

6 files changed

+130
-9
lines changed

‎SPECS/nghttp2/CVE-2026-27135.patch‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
From 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1 Mon Sep 17 00:00:00 2001
2+
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
3+
Date: Wed, 18 Feb 2026 18:04:30 +0900
4+
Subject: [PATCH] Fix missing iframe->state validations to avoid assertion
5+
failure
6+
7+
Upstream Patch reference: https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1.patch
8+
---
9+
lib/nghttp2_session.c | 40 ++++++++++++++++++++++++++++++++++++----
10+
1 file changed, 36 insertions(+), 4 deletions(-)
11+
12+
diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c
13+
index ced7517..ac9301b 100644
14+
--- a/lib/nghttp2_session.c
15+
+++ b/lib/nghttp2_session.c
16+
@@ -6031,6 +6031,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
17+
return rv;
18+
}
19+
20+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
21+
+ return (ssize_t)inlen;
22+
+ }
23+
+
24+
on_begin_frame_called = 1;
25+
26+
rv = session_process_headers_frame(session);
27+
@@ -6397,6 +6401,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
28+
if (nghttp2_is_fatal(rv)) {
29+
return rv;
30+
}
31+
+
32+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
33+
+ return (ssize_t)inlen;
34+
+ }
35+
}
36+
}
37+
38+
@@ -6653,6 +6661,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
39+
return rv;
40+
}
41+
42+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
43+
+ return (ssize_t)inlen;
44+
+ }
45+
+
46+
session_inbound_frame_reset(session);
47+
48+
break;
49+
@@ -6956,6 +6968,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
50+
if (nghttp2_is_fatal(rv)) {
51+
return rv;
52+
}
53+
+
54+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
55+
+ return (ssize_t)inlen;
56+
+ }
57+
} else {
58+
iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK;
59+
}
60+
@@ -7121,13 +7137,17 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
61+
rv = session->callbacks.on_data_chunk_recv_callback(
62+
session, iframe->frame.hd.flags, iframe->frame.hd.stream_id,
63+
in - readlen, (size_t)data_readlen, session->user_data);
64+
- if (rv == NGHTTP2_ERR_PAUSE) {
65+
- return (ssize_t)(in - first);
66+
- }
67+
-
68+
if (nghttp2_is_fatal(rv)) {
69+
return NGHTTP2_ERR_CALLBACK_FAILURE;
70+
}
71+
+
72+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
73+
+ return (ssize_t)inlen;
74+
+ }
75+
+
76+
+ if (rv == NGHTTP2_ERR_PAUSE) {
77+
+ return (ssize_t)(in - first);
78+
+ }
79+
}
80+
}
81+
}
82+
@@ -7208,6 +7228,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
83+
return rv;
84+
}
85+
86+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
87+
+ return (ssize_t)inlen;
88+
+ }
89+
+
90+
if (rv != 0) {
91+
busy = 1;
92+
93+
@@ -7226,6 +7250,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
94+
return rv;
95+
}
96+
97+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
98+
+ return (ssize_t)inlen;
99+
+ }
100+
+
101+
session_inbound_frame_reset(session);
102+
103+
break;
104+
@@ -7254,6 +7282,10 @@ ssize_t nghttp2_session_mem_recv(nghttp2_session *session, const uint8_t *in,
105+
return rv;
106+
}
107+
108+
+ if (iframe->state == NGHTTP2_IB_IGN_ALL) {
109+
+ return (ssize_t)inlen;
110+
+ }
111+
+
112+
session_inbound_frame_reset(session);
113+
114+
break;
115+
--
116+
2.43.0
117+

‎SPECS/nghttp2/nghttp2.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
Summary: nghttp2 is an implementation of HTTP/2 and its header compression algorithm, HPACK.
22
Name: nghttp2
33
Version: 1.57.0
4-
Release: 2%{?dist}
4+
Release: 3%{?dist}
55
License: MIT
66
Vendor: Microsoft Corporation
77
Distribution: Mariner
88
Group: Applications/System
99
URL: https://nghttp2.org
1010
Source0: https://github.com/nghttp2/nghttp2/releases/download/v%{version}/%{name}-%{version}.tar.xz
1111
Patch0: CVE-2024-28182.patch
12+
Patch1: CVE-2026-27135.patch
1213
BuildRequires: gcc
1314
BuildRequires: make
1415
%if %{with_check}
@@ -60,6 +61,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
6061
%{_libdir}/pkgconfig/*.pc
6162

6263
%changelog
64+
* Fri Mar 20 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 1.57.0-3
65+
- Patch for CVE-2026-27135
66+
6367
* Tue Oct 08 2024 Muhammad Falak <mwani@microsoft.com> - 1.57.0-2
6468
- Address CVE-2024-28182
6569

‎toolkit/resources/manifests/package/pkggen_core_aarch64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ libsolv-devel-0.7.24-1.cm2.aarch64.rpm
189189
libssh2-1.9.0-4.cm2.aarch64.rpm
190190
libssh2-devel-1.9.0-4.cm2.aarch64.rpm
191191
krb5-1.19.4-5.cm2.aarch64.rpm
192-
nghttp2-1.57.0-2.cm2.aarch64.rpm
192+
nghttp2-1.57.0-3.cm2.aarch64.rpm
193193
curl-8.8.0-8.cm2.aarch64.rpm
194194
curl-devel-8.8.0-8.cm2.aarch64.rpm
195195
curl-libs-8.8.0-8.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/pkggen_core_x86_64.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -189,7 +189,7 @@ libsolv-devel-0.7.24-1.cm2.x86_64.rpm
189189
libssh2-1.9.0-4.cm2.x86_64.rpm
190190
libssh2-devel-1.9.0-4.cm2.x86_64.rpm
191191
krb5-1.19.4-5.cm2.x86_64.rpm
192-
nghttp2-1.57.0-2.cm2.x86_64.rpm
192+
nghttp2-1.57.0-3.cm2.x86_64.rpm
193193
curl-8.8.0-8.cm2.x86_64.rpm
194194
curl-devel-8.8.0-8.cm2.x86_64.rpm
195195
curl-libs-8.8.0-8.cm2.x86_64.rpm

‎toolkit/resources/manifests/package/toolchain_aarch64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -261,9 +261,9 @@ newt-0.52.21-5.cm2.aarch64.rpm
261261
newt-debuginfo-0.52.21-5.cm2.aarch64.rpm
262262
newt-devel-0.52.21-5.cm2.aarch64.rpm
263263
newt-lang-0.52.21-5.cm2.aarch64.rpm
264-
nghttp2-1.57.0-2.cm2.aarch64.rpm
265-
nghttp2-debuginfo-1.57.0-2.cm2.aarch64.rpm
266-
nghttp2-devel-1.57.0-2.cm2.aarch64.rpm
264+
nghttp2-1.57.0-3.cm2.aarch64.rpm
265+
nghttp2-debuginfo-1.57.0-3.cm2.aarch64.rpm
266+
nghttp2-devel-1.57.0-3.cm2.aarch64.rpm
267267
ninja-build-1.10.2-2.cm2.aarch64.rpm
268268
ninja-build-debuginfo-1.10.2-2.cm2.aarch64.rpm
269269
npth-1.6-4.cm2.aarch64.rpm

‎toolkit/resources/manifests/package/toolchain_x86_64.txt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -267,9 +267,9 @@ newt-0.52.21-5.cm2.x86_64.rpm
267267
newt-debuginfo-0.52.21-5.cm2.x86_64.rpm
268268
newt-devel-0.52.21-5.cm2.x86_64.rpm
269269
newt-lang-0.52.21-5.cm2.x86_64.rpm
270-
nghttp2-1.57.0-2.cm2.x86_64.rpm
271-
nghttp2-debuginfo-1.57.0-2.cm2.x86_64.rpm
272-
nghttp2-devel-1.57.0-2.cm2.x86_64.rpm
270+
nghttp2-1.57.0-3.cm2.x86_64.rpm
271+
nghttp2-debuginfo-1.57.0-3.cm2.x86_64.rpm
272+
nghttp2-devel-1.57.0-3.cm2.x86_64.rpm
273273
ninja-build-1.10.2-2.cm2.x86_64.rpm
274274
ninja-build-debuginfo-1.10.2-2.cm2.x86_64.rpm
275275
npth-1.6-4.cm2.x86_64.rpm

0 commit comments

Comments
 (0)