From c7a11e34a20ad1d011ba08b74adb39cf494c1430 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 13 Apr 2026 00:08:24 -0400 Subject: [PATCH] import UBI nghttp2-1.64.0-2.el10_1.1 --- 0001-nghttp2-1.64.0-CVE-2026-27135.patch | 144 +++++++++++++++++++++++ nghttp2.spec | 8 +- 2 files changed, 151 insertions(+), 1 deletion(-) create mode 100644 0001-nghttp2-1.64.0-CVE-2026-27135.patch diff --git a/0001-nghttp2-1.64.0-CVE-2026-27135.patch b/0001-nghttp2-1.64.0-CVE-2026-27135.patch new file mode 100644 index 0000000..289bce8 --- /dev/null +++ b/0001-nghttp2-1.64.0-CVE-2026-27135.patch @@ -0,0 +1,144 @@ +From 824299d70585afb2fdf7b87ac144343529ee32ae Mon Sep 17 00:00:00 2001 +From: Tatsuhiro Tsujikawa +Date: Wed, 18 Feb 2026 22:40:57 +0900 +Subject: [PATCH] CVE-2026-27135 + +Check nghttp2_is_fatal first + +(cherry picked from commit 68f77a347544c207eeff7ff7457284697ccf7f7d) + +Fix missing iframe->state validations to avoid assertion failure + +(cherry picked from commit 5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1) +--- + lib/nghttp2_session.c | 48 +++++++++++++++++++++++++++++++++++-------- + 1 file changed, 40 insertions(+), 8 deletions(-) + +diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c +index df33a89e..01ed39fb 100644 +--- a/lib/nghttp2_session.c ++++ b/lib/nghttp2_session.c +@@ -5980,6 +5980,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + busy = 1; + + rv = session_on_data_received_fail_fast(session); ++ if (nghttp2_is_fatal(rv)) { ++ return rv; ++ } ++ + if (iframe->state == NGHTTP2_IB_IGN_ALL) { + return (nghttp2_ssize)inlen; + } +@@ -5990,10 +5994,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + break; + } + +- if (nghttp2_is_fatal(rv)) { +- return rv; +- } +- + rv = inbound_frame_handle_pad(iframe, &iframe->frame.hd); + if (rv < 0) { + rv = nghttp2_session_terminate_session_with_reason( +@@ -6063,6 +6063,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + return rv; + } + ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } ++ + on_begin_frame_called = 1; + + rv = session_process_headers_frame(session); +@@ -6429,6 +6433,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + if (nghttp2_is_fatal(rv)) { + return rv; + } ++ ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } + } + } + +@@ -6684,6 +6692,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + return rv; + } + ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } ++ + session_inbound_frame_reset(session); + + break; +@@ -6986,6 +6998,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + if (nghttp2_is_fatal(rv)) { + return rv; + } ++ ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } + } else { + iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK; + } +@@ -7151,13 +7167,17 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + rv = session->callbacks.on_data_chunk_recv_callback( + session, iframe->frame.hd.flags, iframe->frame.hd.stream_id, + in - readlen, (size_t)data_readlen, session->user_data); +- if (rv == NGHTTP2_ERR_PAUSE) { +- return (nghttp2_ssize)(in - first); +- } +- + if (nghttp2_is_fatal(rv)) { + return NGHTTP2_ERR_CALLBACK_FAILURE; + } ++ ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } ++ ++ if (rv == NGHTTP2_ERR_PAUSE) { ++ return (nghttp2_ssize)(in - first); ++ } + } + } + } +@@ -7237,6 +7257,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + return rv; + } + ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } ++ + if (rv != 0) { + busy = 1; + +@@ -7255,6 +7279,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + return rv; + } + ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } ++ + session_inbound_frame_reset(session); + + break; +@@ -7283,6 +7311,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session, + return rv; + } + ++ if (iframe->state == NGHTTP2_IB_IGN_ALL) { ++ return (nghttp2_ssize)inlen; ++ } ++ + session_inbound_frame_reset(session); + + break; +-- +2.53.0 + diff --git a/nghttp2.spec b/nghttp2.spec index 69e9fe4..ab7ecef 100644 --- a/nghttp2.spec +++ b/nghttp2.spec @@ -7,7 +7,7 @@ Summary: Experimental HTTP/2 client, server and proxy Name: nghttp2 Version: 1.64.0 -Release: 2%{?dist} +Release: 2%{?dist}.1 # Parts of ruby bindings are additionally under GPL-2.0-or-later, MIT and # HPND-Kevlin-Henney but they are NOT shipped. @@ -18,6 +18,9 @@ Source0: https://github.com/tatsuhiro-t/nghttp2/releases/download/v%{version}/ng Source1: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-%{version}.tar.xz.asc Source2: tatsuhiro-t.pgp +# fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) +Patch1: 0001-nghttp2-1.64.0-CVE-2026-27135.patch + BuildRequires: CUnit-devel BuildRequires: c-ares-devel BuildRequires: gcc-c++ @@ -212,6 +215,9 @@ popd %changelog +* Thu Apr 09 2026 Jan Macku 1.64.0-2.1 +- fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) + * Tue Oct 29 2024 Troy Dawson - 1.64.0-2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018