Red Hat Product Errata RHSA-2026:8868 - Security Advisory
Issued:
2026-04-20
Updated:
2026-04-20

RHSA-2026:8868 - Security Advisory

Synopsis

Important: nghttp2 security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for nghttp2 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le
  • Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x
  • Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x
  • Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64

Fixes

  • BZ - 2448754 - CVE-2026-27135 nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
x86_64
libnghttp2-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 8fa9d2e929971205a9666c95b29684f9f464ddfaf60de4a137222ca21785ae96
libnghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 65bb2b9fea183eceb154db289bc3f8a6bd48a86173599622d92c8f3003c25186
libnghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 65bb2b9fea183eceb154db289bc3f8a6bd48a86173599622d92c8f3003c25186
libnghttp2-devel-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 5d4ad26d9d64e0e5168046d2c0c56a9316b1887ddb8c4c4d8507c397da66a5ea
nghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: ab19af87b61a938dcd28ac7d423cb86f8b0c8350e98ebd07d4103028b86235bc
nghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: ab19af87b61a938dcd28ac7d423cb86f8b0c8350e98ebd07d4103028b86235bc
nghttp2-debugsource-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: b8ac6310fe6a67b26c259fb10087f86b7308826de84289632b6939a2d0a4870a
nghttp2-debugsource-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: b8ac6310fe6a67b26c259fb10087f86b7308826de84289632b6939a2d0a4870a

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
s390x
libnghttp2-1.64.0-2.el10_0.1.s390x.rpm SHA-256: f6293e40feab23b2a0cb652627a4f162fdfb92f601f3e2cdcc92b6616f9bfa30
libnghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 756da3caaf1666c56034a996cde228cfbe29d0c250a06b36baebd54da039c732
libnghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 756da3caaf1666c56034a996cde228cfbe29d0c250a06b36baebd54da039c732
libnghttp2-devel-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 732921be2d3949dbab8d46623117a424c606383fb47c8569b259551744329af5
nghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 694d234d1d930d303080529657a85bf95f249bb4c80d4e17ae8bffafdb56a6f6
nghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 694d234d1d930d303080529657a85bf95f249bb4c80d4e17ae8bffafdb56a6f6
nghttp2-debugsource-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 4646617478d9bdcf4bf41256f6a49fc13e7a85f539e03e1db5b94328609c7c93
nghttp2-debugsource-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 4646617478d9bdcf4bf41256f6a49fc13e7a85f539e03e1db5b94328609c7c93

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
ppc64le
libnghttp2-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: de6bd5b7a7c55b98190b853616c3c026431ad753a6affc272d396dbb0a0155bb
libnghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 04979bbe325f845e9672573654ff76e1bea0b83d9162c36ec65df03e21301bdc
libnghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 04979bbe325f845e9672573654ff76e1bea0b83d9162c36ec65df03e21301bdc
libnghttp2-devel-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: d599b244c41cd7b4add865c947a780c21c20ed15be113a14c634ffd7bb08805a
nghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 6ac10e867bf4a7f95d95bcf8eb85459f405edb5beaadd0db4d55b16469b1f4c0
nghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 6ac10e867bf4a7f95d95bcf8eb85459f405edb5beaadd0db4d55b16469b1f4c0
nghttp2-debugsource-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 28bb6310f60377f08847acdbb45249993045e21c78595e12ba34f0095dceb2aa
nghttp2-debugsource-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 28bb6310f60377f08847acdbb45249993045e21c78595e12ba34f0095dceb2aa

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
aarch64
libnghttp2-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: c79aed805f0c28a5a54305b4314844861af448b25fbae218b84a65ae1582dc44
libnghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 0ac1ff76a672cdc86707895451053d6ac2bb45553b927be40153cf4031e4b5c6
libnghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 0ac1ff76a672cdc86707895451053d6ac2bb45553b927be40153cf4031e4b5c6
libnghttp2-devel-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 34541f33151a5ff942a06cc62869d84b0302dad5f7d65f09369e7b96c0979ef9
nghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 692d4958ace1f11f7082752e8c4775289471e6db5c8de64bf2825e7e33ed3eeb
nghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 692d4958ace1f11f7082752e8c4775289471e6db5c8de64bf2825e7e33ed3eeb
nghttp2-debugsource-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: fbd6c3754ec98a54bd843ef509d645ab32553c029da6f5541bf7b22d6f7926f0
nghttp2-debugsource-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: fbd6c3754ec98a54bd843ef509d645ab32553c029da6f5541bf7b22d6f7926f0

Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0

SRPM
x86_64
libnghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 65bb2b9fea183eceb154db289bc3f8a6bd48a86173599622d92c8f3003c25186
nghttp2-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 12c5fca358879ba8f0943be07a1be9562c6a0c09b0a7bfc90abca2e55506ad0b
nghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: ab19af87b61a938dcd28ac7d423cb86f8b0c8350e98ebd07d4103028b86235bc
nghttp2-debugsource-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: b8ac6310fe6a67b26c259fb10087f86b7308826de84289632b6939a2d0a4870a

Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0

SRPM
ppc64le
libnghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 04979bbe325f845e9672573654ff76e1bea0b83d9162c36ec65df03e21301bdc
nghttp2-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: c57fc43d9d841cc939f0c976a883274c388102ca8fd3e019d8d7f3ee6ed3b6ac
nghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 6ac10e867bf4a7f95d95bcf8eb85459f405edb5beaadd0db4d55b16469b1f4c0
nghttp2-debugsource-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 28bb6310f60377f08847acdbb45249993045e21c78595e12ba34f0095dceb2aa

Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0

SRPM
s390x
libnghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 756da3caaf1666c56034a996cde228cfbe29d0c250a06b36baebd54da039c732
nghttp2-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 3bcbfa70cb160379e321fef7315246791e9ad5807e340cd6ecf404395f34d8ab
nghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 694d234d1d930d303080529657a85bf95f249bb4c80d4e17ae8bffafdb56a6f6
nghttp2-debugsource-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 4646617478d9bdcf4bf41256f6a49fc13e7a85f539e03e1db5b94328609c7c93

Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0

SRPM
aarch64
libnghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 0ac1ff76a672cdc86707895451053d6ac2bb45553b927be40153cf4031e4b5c6
nghttp2-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 29a41af7c5091a98e8ad8576242107220e958ffdb500a3c5e0a9a0d4dcb82812
nghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 692d4958ace1f11f7082752e8c4775289471e6db5c8de64bf2825e7e33ed3eeb
nghttp2-debugsource-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: fbd6c3754ec98a54bd843ef509d645ab32553c029da6f5541bf7b22d6f7926f0

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
aarch64
libnghttp2-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: c79aed805f0c28a5a54305b4314844861af448b25fbae218b84a65ae1582dc44
libnghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 0ac1ff76a672cdc86707895451053d6ac2bb45553b927be40153cf4031e4b5c6
libnghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 0ac1ff76a672cdc86707895451053d6ac2bb45553b927be40153cf4031e4b5c6
libnghttp2-devel-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 34541f33151a5ff942a06cc62869d84b0302dad5f7d65f09369e7b96c0979ef9
nghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 692d4958ace1f11f7082752e8c4775289471e6db5c8de64bf2825e7e33ed3eeb
nghttp2-debuginfo-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: 692d4958ace1f11f7082752e8c4775289471e6db5c8de64bf2825e7e33ed3eeb
nghttp2-debugsource-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: fbd6c3754ec98a54bd843ef509d645ab32553c029da6f5541bf7b22d6f7926f0
nghttp2-debugsource-1.64.0-2.el10_0.1.aarch64.rpm SHA-256: fbd6c3754ec98a54bd843ef509d645ab32553c029da6f5541bf7b22d6f7926f0

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
s390x
libnghttp2-1.64.0-2.el10_0.1.s390x.rpm SHA-256: f6293e40feab23b2a0cb652627a4f162fdfb92f601f3e2cdcc92b6616f9bfa30
libnghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 756da3caaf1666c56034a996cde228cfbe29d0c250a06b36baebd54da039c732
libnghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 756da3caaf1666c56034a996cde228cfbe29d0c250a06b36baebd54da039c732
libnghttp2-devel-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 732921be2d3949dbab8d46623117a424c606383fb47c8569b259551744329af5
nghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 694d234d1d930d303080529657a85bf95f249bb4c80d4e17ae8bffafdb56a6f6
nghttp2-debuginfo-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 694d234d1d930d303080529657a85bf95f249bb4c80d4e17ae8bffafdb56a6f6
nghttp2-debugsource-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 4646617478d9bdcf4bf41256f6a49fc13e7a85f539e03e1db5b94328609c7c93
nghttp2-debugsource-1.64.0-2.el10_0.1.s390x.rpm SHA-256: 4646617478d9bdcf4bf41256f6a49fc13e7a85f539e03e1db5b94328609c7c93

Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
ppc64le
libnghttp2-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: de6bd5b7a7c55b98190b853616c3c026431ad753a6affc272d396dbb0a0155bb
libnghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 04979bbe325f845e9672573654ff76e1bea0b83d9162c36ec65df03e21301bdc
libnghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 04979bbe325f845e9672573654ff76e1bea0b83d9162c36ec65df03e21301bdc
libnghttp2-devel-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: d599b244c41cd7b4add865c947a780c21c20ed15be113a14c634ffd7bb08805a
nghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 6ac10e867bf4a7f95d95bcf8eb85459f405edb5beaadd0db4d55b16469b1f4c0
nghttp2-debuginfo-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 6ac10e867bf4a7f95d95bcf8eb85459f405edb5beaadd0db4d55b16469b1f4c0
nghttp2-debugsource-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 28bb6310f60377f08847acdbb45249993045e21c78595e12ba34f0095dceb2aa
nghttp2-debugsource-1.64.0-2.el10_0.1.ppc64le.rpm SHA-256: 28bb6310f60377f08847acdbb45249993045e21c78595e12ba34f0095dceb2aa

Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0

SRPM
nghttp2-1.64.0-2.el10_0.1.src.rpm SHA-256: 357813c767d40463628d027146147eea2c4232c67e62acf752bac65138741435
x86_64
libnghttp2-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 8fa9d2e929971205a9666c95b29684f9f464ddfaf60de4a137222ca21785ae96
libnghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 65bb2b9fea183eceb154db289bc3f8a6bd48a86173599622d92c8f3003c25186
libnghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 65bb2b9fea183eceb154db289bc3f8a6bd48a86173599622d92c8f3003c25186
libnghttp2-devel-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: 5d4ad26d9d64e0e5168046d2c0c56a9316b1887ddb8c4c4d8507c397da66a5ea
nghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: ab19af87b61a938dcd28ac7d423cb86f8b0c8350e98ebd07d4103028b86235bc
nghttp2-debuginfo-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: ab19af87b61a938dcd28ac7d423cb86f8b0c8350e98ebd07d4103028b86235bc
nghttp2-debugsource-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: b8ac6310fe6a67b26c259fb10087f86b7308826de84289632b6939a2d0a4870a
nghttp2-debugsource-1.64.0-2.el10_0.1.x86_64.rpm SHA-256: b8ac6310fe6a67b26c259fb10087f86b7308826de84289632b6939a2d0a4870a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.