CVE-2026-27135
HighAdvisory
Published 18 Mar 2026In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.008
- 54th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 1,451
- of 17,790 indexed, latest versions
- Container images
- 1,503
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
Red Hat Security Advisory: nghttp2 security update
Carried by container images the latest versions of 1,451 of 17,790 indexed charts deploy, on 1,503 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| nghttp2deb | 1.30.0-1ubuntu1, 1.40.0-1build1, 1.40.0-1ubuntu0.1, 1.40.0-1ubuntu0.2+11 more | 1.30.0-1ubuntu1+esm3, 1.40.0-1ubuntu0.3+esm1, 1.43.0-1ubuntu0.3, 1.52.0-1+deb12u3+3 more | 935 |
| nghttp2rpm | 1.33.0-1.el8, 1.33.0-1.el8_0.1, 1.33.0-3.el8_2.1, 1.33.0-3.el8_2.2+13 more | 0:1.33.0-6.el8_10.2, 0:1.43.0-6.el9_7.1, 0:1.64.0-2.el10_1.1, 1.64.0-150700.3.3.1+1 more | 322 |
| nghttp2apk | 1.57.0-r0, 1.64.0-r0, 1.65.0-r0, 1.68.0-r0 | 1.68.1 | 246 |
- OSV records
- ALPINE-CVE-2026-27135DEBIAN-CVE-2026-27135RHSA-2026:7666RHSA-2026:7667RHSA-2026:7668RLSA-2026:7667RLSA-2026:7668UBUNTU-CVE-2026-27135openSUSE-SU-2026:10437-1SUSE-SU-2026:1074-1
- Also known as
- RHSA-2026:8538, RHSA-2026:8539, RHSA-2026:8540, RHSA-2026:8541, RHSA-2026:8545, RHSA-2026:8547, RHSA-2026:8548, USN-8233-1
Charts affected
1,451 by stars
Container images carrying it
1,503 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| library/ | 3b6c281e1c08 | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| library/ | 3d0e6df9fd5b | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| library/ | 50cae5081ab4 | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| library/ | 646902910d6a | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| library/ | 699d652ed674 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| library/ | 6ca49afbcb2b | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| library/ | 71a63fc2438e | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| library/ | 7c81758cb295 | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| library/ | 88785f6f665a | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| library/ | 9cb28f7291d9 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| library/ | ae1cf99fa7bf | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| library/ | d23ec07162ca | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| library/ | dca8d11fe467 | nghttp2 | 1.59.0-1ubuntu0.3 | 1 |
| library/ | 588609d76b21 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | b7faa1653c39 | nghttp2 | 1.64.0-1.1+deb13u1 | 1 |
| library/ | 09369da6b103 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | 1881968aff6f | nghttp2 | 1.64.0-1.1+deb13u1 | 1 |
| library/ | 5616878291a2 | nghttp2 | 1.68.1 | 1 |
| library/ | 65645c7bb6a0 | nghttp2 | 1.68.1 | 1 |
| library/ | 6784fb0834aa | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | 67f9a4f10d14 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | 9ff236ed47fe | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | a8b39bd9cf0f | nghttp2 | 1.68.1 | 1 |
| library/ | b3c656d55d7a | nghttp2 | 1.68.1 | 1 |
| library/ | fb197595ebe7 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | 8f693eaa7e0a | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | a2482c398d60 | nghttp2 | 1.68.1 | 1 |
| library/ | 54451ecb8ab3 | nghttp2 | 1.68.1 | 1 |
| library/ | d41127070014 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | da5aee29682d | nghttp2 | 1.64.0-1.1+deb13u1 | 1 |
| library/ | 0842dcd4c8f8 | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| library/ | ef9723cf4fe4 | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| library/ | 507a3eecf809 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | 8ae66efb09a2 | nghttp2 | 1.52.0-1+deb12u3 | 1 |
| library/ | f73396626d2f | nghttp2 | 1.64.0-1.1+deb13u1 | 1 |
| library/ | 55d1e5b2e601 | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| library/ | dfa9ba46d14b | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| linkstackorg/ | 1c8b05399ee4 | nghttp2 | 1.68.1 | 1 |
| linuxserver/ | a847b5b2d860 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| linuxserver/ | 241009026e6f | nghttp2 | 1.59.0-1ubuntu0.3 | 1 |
| linuxserver/ | 938810eca3d3 | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| linuxserver/ | 45c5fe102ff3 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| linuxserver/ | a5e43a05ae79 | nghttp2 | 1.43.0-1ubuntu0.3 | 1 |
| linuxserver/ | b801bbcf6386 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| linuxserver/ | 052eac68ccc0 | nghttp2 | 1.68.1 | 1 |
| linuxserver/ | 0ac871624394 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| linuxserver/ | 2ce561a95e7b | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |
| linuxserver/ | 9a997426d71e | nghttp2 | 1.59.0-1ubuntu0.3 | 1 |
| linuxserver/ | 2427dde159a2 | nghttp2 | 1.40.0-1ubuntu0.3+esm1 | 1 |
| linuxserver/ | f93d2560e233 | nghttp2 | 1.30.0-1ubuntu1+esm3 | 1 |