ELSA-2026-7666

ELSA-2026-7666 - nghttp2 security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-04-12

Description

[1.64.0-2.1]
- fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135)

Related CVEs

CVE-2026-27135

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_aarch64_appstream
	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_aarch64_baseos_latest
	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_aarch64_codeready_builder
	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_aarch64_u1_baseos_patch
	libnghttp2-1.64.0-2.el10_1.1.aarch64.rpm	c072cb168461ed8a0c87c571dbb5d62b198e13dae90800acfbd771abe2da81df	-	ol10_aarch64_baseos_latest
	libnghttp2-1.64.0-2.el10_1.1.aarch64.rpm	c072cb168461ed8a0c87c571dbb5d62b198e13dae90800acfbd771abe2da81df	-	ol10_aarch64_u1_baseos_patch
	libnghttp2-devel-1.64.0-2.el10_1.1.aarch64.rpm	e1e401511914b32465b2581941f94d0b5a5b8179daef4503eaa7f0153757ead1	-	ol10_aarch64_appstream
	nghttp2-1.64.0-2.el10_1.1.aarch64.rpm	33f602da9f0be44c56da07db2c592b2e728fc20b4d4b9c7a9f7e407525fd410e	-	ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64)	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_x86_64_appstream
	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_x86_64_baseos_latest
	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_x86_64_codeready_builder
	nghttp2-1.64.0-2.el10_1.1.src.rpm	4af21a3643c56d01c2edd69fcfc1f2b188efe29ba53649747520f602f086c6c2	-	ol10_x86_64_u1_baseos_patch
	libnghttp2-1.64.0-2.el10_1.1.x86_64.rpm	62232ea1c420dea3ed556b0aa29dfcac01ff34f44b1762cb03f20fc75d8f63d9	-	ol10_x86_64_baseos_latest
	libnghttp2-1.64.0-2.el10_1.1.x86_64.rpm	62232ea1c420dea3ed556b0aa29dfcac01ff34f44b1762cb03f20fc75d8f63d9	-	ol10_x86_64_u1_baseos_patch
	libnghttp2-devel-1.64.0-2.el10_1.1.x86_64.rpm	b0c725dde66e3de6f0af2d486b304ecba7329d9e0e90554a970d498c7a4359e5	-	ol10_x86_64_appstream
	nghttp2-1.64.0-2.el10_1.1.x86_64.rpm	78d2f7bb8697c38bd584ff6967b58cb909e68646ae3523d2358a5a18da751bd2	-	ol10_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team