BSD Portsnghttp2 -- CWE-617: Reachable Assertion
· CVE-2026-27135 · VuXML entry
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6933-cjhr-5qg6 reports: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API `nghttp2_session_terminate_session` or `nghttp2_session_terminate_session2` is called by the application. They might be called internally by the …
Affected versions
- libnghttp2 < 1.68.1
- nghttp2 < 1.68.1
By system
2 still vulnerable, 2 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | www/libnghttp2 | 1.65.0 | vulnerable since 2026-04-05 | |
| MidnightBSD | www/libnghttp2 | 1.68.0 | in range, by version | |
| FreeBSD | www/libnghttp2 | 1.70.0 | fixed | (141 days after) |
| DragonFly | www/nghttp2 | 1.58.0 | vulnerable since 2026-04-05 | |
| OpenBSD | www/nghttp2 | 1.70.0 | out of range, by version | |
| NetBSD | www/nghttp2 | 1.70.0 | not listed | |
| MidnightBSD | www/nghttp2 | 1.68.0_2 | in range, by version | |
| FreeBSD | www/nghttp2 | 1.70.0 | fixed | (141 days after) |