Skip to content
Fencer Vulns
high 7.5

CVE-2026-27135 json

nghttp2 Denial of service: Assertion failure due to the missing state validation

published 2026-03-18 7 mo ago modified 2026-10-15 25 d ago also EUVD-2026-12919 , JLSEC-2026-5

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Patch / fix

  • julia nghttp2_jll 1.68.1+0
  • Red Hat JBoss Core Services for RHEL 8 0:1.64.0-3.el8jbcs
  • Red Hat JBoss Core Services on RHEL 7 0:1.64.0-3.el7jbcs
  • Red Hat Red Hat Enterprise Linux 10 0:1.64.0-2.el10_1.1, 1:22.22.2-1.el10_1, 1:24.14.1-2.el10_1
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:1.64.0-2.el10_0.1, 1:22.22.2-2.el10_0
  • Red Hat Red Hat Enterprise Linux 8 0:1.33.0-6.el8_10.2, 8100020260331102257.6d880403, 8100020260408131901.6d880403, 8100020260414073138.489197e6
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.33.0-3.el8_2.4
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 0:1.33.0-4.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 0:1.33.0-4.el8_4.3
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:1.33.0-4.el8_6.3
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service 0:1.33.0-4.el8_6.3
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions 0:1.33.0-4.el8_6.3
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:1.33.0-5.el8_8.2
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:1.33.0-5.el8_8.2
  • Red Hat Red Hat Enterprise Linux 9 0:1.43.0-6.el9_7.1, 9070020260401095228.rhel9, 9070020260402152654.rhel9, 9070020260409073121.rhel9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 0:1.43.0-5.el9_0.4
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:1.43.0-5.el9_2.4
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support 0:1.43.0-5.el9_4.4, 9040020260421133644.rhel9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:1.43.0-6.el9_6.1, 9060020260409121057.rhel9, 9060020260422064119.rhel9
  • Red Hat Red Hat OpenShift Container Platform 4.12 412.86.202605271418-0
  • Red Hat Red Hat OpenShift Container Platform 4.13 413.92.202605271328-0
  • Red Hat Red Hat OpenShift Container Platform 4.14 414.92.202605060243-0
  • Red Hat Red Hat OpenShift Container Platform 4.15 415.92.202605060220-0
  • Red Hat Red Hat OpenShift Container Platform 4.16 416.94.202605200242-0
  • Red Hat Red Hat OpenShift Container Platform 4.17 417.94.202605112123-0
  • Red Hat Red Hat OpenShift Container Platform 4.18 418.94.202605260517-0
  • Red Hat Red Hat OpenShift Container Platform 4.19 4.19.9.6.202605201155-0
  • Red Hat RHEL-8 based Middleware Containers 7.13.5-3.1777325680, 7.13.5-4.1777325677, 7.13.5-4.1777325680, 7.13.5-4.1777325708, 7.13.5-4.1777325709, 7.13.5-4.1777325710, 7.13.5-4.1777325711
  • Red Hat Red Hat AI Inference Server 3.2 1779223651, 1779223654, 1780681984
  • Red Hat Red Hat AI Inference Server 3.3 1778244531, 1778244546, 1778244559, 1778274666
  • nghttp2 Debian 12 1.52.0-1+deb12u3
  • nghttp2 Debian 13 1.64.0-1.1+deb13u1
  • nghttp2 Debian 14 1.68.1-1

debian advisories DEBIAN-CVE-2026-27135

  • nghttp2 Ubuntu 22.04 LTS 1.43.0-1ubuntu0.3
  • nghttp2 Ubuntu 24.04 LTS 1.59.0-1ubuntu0.3
  • nghttp2 Ubuntu 25.10 1.64.0-1.1ubuntu1.1
  • nghttp2 Ubuntu 26.04 LTS 1.68.0-2ubuntu0.1
  • nghttp2 Ubuntu Pro 16.04 LTS 1.7.1-1ubuntu0.1~esm3
  • nghttp2 Ubuntu Pro 18.04 LTS 1.30.0-1ubuntu1+esm3
  • nghttp2 Ubuntu Pro 20.04 LTS 1.40.0-1ubuntu0.3+esm1

ubuntu advisories UBUNTU-CVE-2026-27135

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nghttp2 hummingbird 1 1.69.0-6.1.hum1
  • libnghttp2 hummingbird 1 1.69.0-6.1.hum1
  • mingw32-libnghttp2 hummingbird 1 1.69.0-6.1.hum1
  • mingw64-libnghttp2 hummingbird 1 1.69.0-6.1.hum1
  • jbcs-httpd24-httpd jboss core services 1 2.4.62-13.el7jbcs
  • jbcs-httpd24-httpd jboss core services 1 2.4.62-13.el8jbcs
  • jbcs-httpd24-mod_md jboss core services 1 1:2.4.28-16.el7jbcs
  • jbcs-httpd24-mod_md jboss core services 1 1:2.4.28-16.el8jbcs

red hat advisories RHSA-2026:77939RHSA-2026:27200RHSA-2026:9874RHSA-2026:9711RHSA-2026:8868RHSA-2026:6190

  • nodejs16 SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +1 more 16.20.2-150400.3.42.1
  • nodejs18 SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 18.20.8-150400.9.39.1
  • nodejs20 SLES for SAP 15 SP5, SLES 15 SP5-LTSS, SLE High Performance Computing 15 SP5-LTSS +1 more 20.20.2-150500.11.30.1
  • nodejs24 SLES for SAP applications 16.0, SLES 16.0 24.18.0-160000.1.1
  • nodejs22 SLE Module for Web and Scripting 15 SP7 22.23.0-150700.3.12.1
  • nodejs24 SLE Module for Web and Scripting 15 SP7 24.17.0-150700.15.11.1
  • nodejs22 SLES for SAP applications 16.0, SLES 16.0 22.23.0-160000.1.1
  • nghttp2 SLES for SAP 15 SP6, SLES 15 SP6-LTSS, SLE Module for Basesystem 15 SP7 +1 more 1.40.0-150600.25.5.1

suse advisories SUSE-SU-2026:4355-1SUSE-SU-2026:4261-1SUSE-SU-2026:4248-1SUSE-SU-2026:3930-1SUSE-SU-2026:3929-1SUSE-SU-2026:22565-1

  • nodejs24 openSUSE Leap 16.0 24.18.0-160000.1.1
  • nodejs22 openSUSE Leap 16.0 22.23.0-160000.1.1
  • nodejs24 openSUSE Tumbleweed 24.17.0-1.1
  • nghttp2 openSUSE Tumbleweed 1.68.1-1.1
  • nghttp2 openSUSE Leap 16.0 1.64.0-160000.3.1

opensuse advisories openSUSE-SU-2026:21236-1openSUSE-SU-2026:21058-1openSUSE-SU-2026:11121-1openSUSE-SU-2026:10437-1openSUSE-SU-2026:20413-1

  • npm AlmaLinux 8 1:10.8.2-1.20.20.2.1.module_el8.10.0+4165+3f200bda
  • nodejs AlmaLinux 8 1:20.20.2-1.module_el8.10.0+4165+3f200bda
  • nodejs-nodemon AlmaLinux 8 3.0.1-1.module_el8.10.0+3982+85c136aa
  • nodejs-full-i18n AlmaLinux 8 1:20.20.2-1.module_el8.10.0+4165+3f200bda
  • nodejs-packaging AlmaLinux 8 2021.06-6.module_el8.10.0+4165+3f200bda
  • nodejs-packaging-bundler AlmaLinux 8 2021.06-6.module_el8.10.0+4165+3f200bda
  • nghttp2 AlmaLinux 10 1.64.0-2.el10_1.1
  • libnghttp2 AlmaLinux 10 1.64.0-2.el10_1.1

almalinux advisories ALSA-2026:8339ALSA-2026:7666ALSA-2026:7667ALSA-2026:7668ALSA-2026:7670ALSA-2026:7675

  • nghttp2 Rocky Linux 8 1.33.0-6.el8_10.2
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1924+614dc87f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1935+d3cbe60f
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1666+930e28e8
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1667+4a788d89
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1989+e60144d9
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.10.0+1988+437f3d23
  • nodejs-nodemon Rocky Linux 8 3.0.1-1.module+el8.9.0+1760+903d54b9

rocky linux advisories RLSA-2026:7667RLSA-2026:8339RLSA-2026:7666RLSA-2026:7675RLSA-2026:7668RLSA-2026:7896

  • nghttp2 Alpine 3.23, Alpine 3.22, Alpine 3.21 1.68.1
  • nghttp2 Alpine 3.24 1.68.1-r0

alpine advisories ALPINE-CVE-2026-27135

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • nghttp2 Azure Linux 3.0 1.61.0-3
  • cmake Azure Linux 3.0 3.30.3-13
  • nodejs Azure Linux 3.0 20.14.0-14

azure linux advisories AZL-80103AZL-80219AZL-80235

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-26-295-11 updated cvss 7.5

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.7 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.7 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.7
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

red hat product security vex CVE-2026-27135 updated cvss 7.5

nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination

  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/cert-manager-operator-bundle 1791970484, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82888
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.18 cert-manager/cert-manager-operator-rhel9 1789029076, cert-manager/jetstack-cert-manager-rhel9 1791459711, cert-manager/cert-manager-istio-csr-rhel9 1791459759, cert-manager/cert-manager-operator-bundle 1791966259, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791459707
    fixed: vendor fix RHSA-2026:82354
  • Red Hat Middleware Containers for OpenShift rhpam-7/rhpam-kieserver-rhel8 7.13.5-4.1777325709, rhpam-7/rhpam-controller-rhel8 7.13.5-4.1777325710, rhpam-7/rhpam-dashbuilder-rhel8 7.13.5-3.1777325680, rhpam-7/rhpam-smartrouter-rhel8 7.13.5-4.1777325708, rhpam-7/rhpam-businesscentral-rhel8 7.13.5-4.1777325711, rhpam-7/rhpam-process-migration-rhel8 7.13.5-4.1777325680, +1 more
    fixed: vendor fix RHSA-2026:13812
  • Red Hat AI Inference Server 3.2 rhaiis 1779223651, rhaiis 1779223654, rhaiis/model-opt-cuda-rhel9 1780681984
    fixed: vendor fix RHSA-2026:25096
  • Red Hat AI Inference Server 3.3 rhaiis 1778244531, rhaiis 1778244546, rhaiis 1778244559, rhaiis 1778274666
    fixed: vendor fix RHSA-2026:16008
  • Red Hat CodeReady Linux Builder EUS (v.9.4) nghttp2 1.43.0-5.el9_4.4
    fixed: vendor fix RHSA-2026:8547
  • Red Hat CodeReady Linux Builder EUS (v.9.6) nghttp2 1.43.0-6.el9_6.1
    fixed: vendor fix RHSA-2026:8548
  • Red Hat Discovery 2 discovery 1778101579, discovery 1778156756
    fixed: vendor fix RHSA-2026:14937
show 30 more
  • Red Hat Enterprise Linux AppStream (v. 8) nodejs 20.20.2-1.module+el8.10.0+24197+1602b452, nodejs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-libs 22.22.2-1.module+el8.10.0+24148+847b6786, nodejs-libs 24.14.1-2.module+el8.10.0+24190+49a46c75, nodejs-nodemon 3.0.1-1.module+el8.10.0+23521+490ebfde, +14 more
    fixed: vendor fix RHSA-2026:8339
  • Red Hat Enterprise Linux AppStream (v. 9) nodejs 20.20.2-1.module+el9.7.0+24193+41b7b572, nodejs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-libs 22.22.2-1.module+el9.7.0+24157+8ddb2461, nodejs-libs 24.14.1-2.module+el9.7.0+24166+51c9666b, nodejs-nodemon 3.0.1-1.module+el9.7.0+24157+8ddb2461, +14 more
    fixed: vendor fix RHSA-2026:7896
  • Red Hat Enterprise Linux AppStream (v. 10) nodejs 22.22.2-1.el10_1, nodejs22 22.22.2-1.el10_1, nodejs24 24.14.1-2.el10_1, nodejs-libs 22.22.2-1.el10_1, nodejs24-libs 24.14.1-2.el10_1, nodejs-full-i18n 22.22.2-1.el10_1, +3 more
    fixed: vendor fix RHSA-2026:7666
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) nodejs 22.22.2-2.el10_0, nodejs22 22.22.2-2.el10_0, nodejs-libs 22.22.2-2.el10_0, nodejs-full-i18n 22.22.2-2.el10_0, nodejs-npm 10.9.7-1.22.22.2.2.el10_0
    fixed: vendor fix RHSA-2026:8868
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) nodejs 20.20.2-2.module+el9.4.0+24216+64c58546, npm 10.8.2-1.20.20.2.2.module+el9.4.0+24216+64c58546, nodejs-nodemon 3.0.1-1.module+el9.3.0.z+20478+84a9f781, nodejs-full-i18n 20.20.2-2.module+el9.4.0+24216+64c58546, nodejs-packaging 2021.06-4.module+el9.3.0+19518+63aad52d, nodejs-packaging-bundler 2021.06-4.module+el9.3.0+19518+63aad52d
    fixed: vendor fix RHSA-2026:9711
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) nodejs 20.20.2-2.module+el9.6.0+24220+c44c288d, nodejs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-libs 22.22.2-1.module+el9.6.0+24196+39669d4e, nodejs-nodemon 3.0.1-1.module+el9.6.0+23146+be9976bd, nodejs-nodemon 3.0.1-1.module+el9.6.0+23473+45664c2d, npm 10.8.2-1.20.20.2.2.module+el9.6.0+24220+c44c288d, +7 more
    fixed: vendor fix RHSA-2026:9874
  • Red Hat Enterprise Linux BaseOS (v. 8) nghttp2 1.33.0-6.el8_10.2, libnghttp2 1.33.0-6.el8_10.2
    fixed: vendor fix RHSA-2026:7667
  • Red Hat Enterprise Linux BaseOS (v. 9) nghttp2 1.43.0-6.el9_7.1, libnghttp2 1.43.0-6.el9_7.1
    fixed: vendor fix RHSA-2026:7668
  • Red Hat Enterprise Linux BaseOS (v. 10) nghttp2 1.64.0-2.el10_1.1, libnghttp2 1.64.0-2.el10_1.1
    fixed: vendor fix RHSA-2026:7666
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) nghttp2 1.33.0-3.el8_2.4, libnghttp2 1.33.0-3.el8_2.4
    fixed: vendor fix RHSA-2026:8541
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) nghttp2 1.33.0-4.el8_4.3, libnghttp2 1.33.0-4.el8_4.3
    fixed: vendor fix RHSA-2026:8539
  • Red Hat Enterprise Linux BaseOS AUS (v.8.6) nghttp2 1.33.0-4.el8_6.3, libnghttp2 1.33.0-4.el8_6.3 Red Hat Enterprise Linux BaseOS E4S (v.8.6) nghttp2 1.33.0-4.el8_6.3, libnghttp2 1.33.0-4.el8_6.3
    fixed: vendor fix RHSA-2026:8538
  • Red Hat Enterprise Linux BaseOS E4S (v.8.8) nghttp2 1.33.0-5.el8_8.2, libnghttp2 1.33.0-5.el8_8.2
    fixed: vendor fix RHSA-2026:8540
  • Red Hat Enterprise Linux BaseOS E4S (v.9.0) nghttp2 1.43.0-5.el9_0.4, libnghttp2 1.43.0-5.el9_0.4
    fixed: vendor fix RHSA-2026:8546
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) nghttp2 1.43.0-5.el9_2.4, libnghttp2 1.43.0-5.el9_2.4
    fixed: vendor fix RHSA-2026:8545
  • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) nghttp2 1.64.0-2.el10_0.1, libnghttp2 1.64.0-2.el10_0.1
    fixed: vendor fix RHSA-2026:8868
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) nghttp2 1.43.0-5.el9_4.4, libnghttp2 1.43.0-5.el9_4.4
    fixed: vendor fix RHSA-2026:8547
  • Red Hat Enterprise Linux BaseOS EUS (v.9.6) nghttp2 1.43.0-6.el9_6.1, libnghttp2 1.43.0-6.el9_6.1
    fixed: vendor fix RHSA-2026:8548
  • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) nghttp2 1.33.0-4.el8_4.3, libnghttp2 1.33.0-4.el8_4.3
    fixed: vendor fix RHSA-2026:8539
  • Red Hat Enterprise Linux BaseOS TUS (v.8.6) nghttp2 1.33.0-4.el8_6.3, libnghttp2 1.33.0-4.el8_6.3
    fixed: vendor fix RHSA-2026:8538
  • Red Hat Enterprise Linux BaseOS TUS (v.8.8) nghttp2 1.33.0-5.el8_8.2, libnghttp2 1.33.0-5.el8_8.2
    fixed: vendor fix RHSA-2026:8540
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nghttp2 1.43.0-6.el9_7.1
    fixed: vendor fix RHSA-2026:7668
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) nghttp2 1.64.0-2.el10_1.1
    fixed: vendor fix RHSA-2026:7666
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) nghttp2 1.64.0-2.el10_0.1
    fixed: vendor fix RHSA-2026:8868
  • Red Hat Enterprise Linux CRB (v. 8) nghttp2 1.33.0-6.el8_10.2
    fixed: vendor fix RHSA-2026:7667
  • Red Hat Hardened Images nghttp2 1.68.1-1.hum1, nghttp2 1.69.0-6.1.hum1, libnghttp2 1.68.1-1.hum1, libnghttp2 1.69.0-6.1.hum1, mingw32-libnghttp2 1.68.1-1.hum1, mingw64-libnghttp2 1.68.1-1.hum1, +2 more
    fixed: vendor fix RHSA-2026:6190
  • Red Hat Insights proxy 1.5 insights-proxy 1776868961
    fixed: vendor fix RHSA-2026:9832
  • Red Hat JBoss Core Services 2.4.62.SP4
    fixed: vendor fix RHSA-2026:27201
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-nghttp2 1.64.0-3.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-nghttp2 1.64.0-3.el8jbcs
    fixed: vendor fix RHSA-2026:27200
  • Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202605271418
    fixed: vendor fix RHSA-2026:21695

8 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-209-04 updated cvss 7.5

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.6 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.6 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.6
    affected: mitigation, no fix available

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.82% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia nghttp2_jll
<1.68.1+0
1.68.1+0

Affected products

  • nghttp2 nghttp2
  • Red Hat JBoss Core Services for RHEL 8
  • Red Hat JBoss Core Services on RHEL 7
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat JBoss Core Services 2.4.62.SP4
  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Red Hat OpenShift Container Platform 4.17
  • Red Hat Red Hat OpenShift Container Platform 4.18
  • Red Hat Red Hat OpenShift Container Platform 4.19
  • Red Hat RHEL-8 based Middleware Containers
  • Red Hat Red Hat AI Inference Server 3.2
  • Red Hat Red Hat AI Inference Server 3.3
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Hardened Images
  • Red Hat Red Hat Insights proxy 1.5
  • Red Hat Red Hat Update Infrastructure 5
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.