nghttp2 Denial of service: Assertion failure due to the missing state validation

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6
advises:
> Impact
> ------
> nghttp2 library stops reading the incoming data when user facing
> public API nghttp2_session_terminate_session or
> nghttp2_session_terminate_session2 is called by the application.
> They might be called internally by the library when it detects the
> situation that is subject to connection error.
>
> Due to the missing internal state validation, the library keeps
> reading the rest of the data after one of those APIs is called. Then
> receiving a malformed frame that causes FRAME_SIZE_ERROR causes
> assertion failure.
>
> nghttp2_session_terminate_session and
> nghttp2_session_terminate_session2 are used interchangeably in the
> rest of this document.
>
> The detailed execution paths that lead to assertion failure are:
>
>   - nghttp2_session_terminate_session is called from
>     nghttp2_on_invalid_frame_recv_callback when processing incoming
>     ALTSVC (RFC 7838) frame, and then a malformed frame that causes
>     FRAME_SIZE_ERROR is received.
>
>   - nghttp2_session_terminate_session is called from
>     nghttp2_on_frame_recv_callback when processing PRIORITY_UPDATE,
>     ALTSVC, or user-defined extension frame, and then a malformed frame
>     that causes FRAME_SIZE_ERROR is received.
>
>   - nghttp2_session_terminate_session is called from
>     nghttp2_on_extension_chunk_recv_callback when processing
>     user-defined extension frame, and then a malformed frame that causes
>     FRAME_SIZE_ERROR is received.
>
>   - nghttp2_session_terminate_session is called from
>     nghttp2_unpack_extension_callback when processing user-defined
>     extension frame, and then a malformed frame that causes
>     FRAME_SIZE_ERROR is received.
>
>   - The malformed PRIORITY_UPDATE frame (e.g., stream_id == 0) is
>     received, and then a malformed frame that causes FRAME_SIZE_ERROR is
>     received.
>
> For PRIORITY_UPDATE and ALTSVC frames, they must be explicitly enabled
> via nghttp2_option_set_builtin_recv_extension_type to be affected.
>
> For user-defined extension frames, they must be explicitly enabled via
> nghttp2_option_set_user_recv_extension_type to be affected.
>
> For the builds that disable assert macro (e.g, -DNDEBUG), it does
> not hit assertion failure, but it might continue reading incoming
> data, which itself does not cause any vulnerability as far as we know.
> We still strongly encourage to apply the patch for those builds as
> well.
>
> The reporter found the cases where ALTSVC is involved. The other
> cases have been investigated and discovered by the nghttp2 development
> team.
>
> Patches
> -------
> nghttp2 v1.68.1 adds missing state validation to avoid assertion
> failure.
>
> Workarounds
> -----------
> There is no workaround.
>
> References
> ----------
> https://github.com/nghttp2/nghttp2/commit/5c7df8fa815ac1004d9ecb9d1f7595c4d37f46e1
> fixes this vulnerability.
>
> Severity
> --------
> High
> 7.5 / 10
> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
>
> CVE ID
> ------
> CVE-2026-27135
>
> Credits
> -------
> @AndrewMohawk