A critical vulnerability in the nghttp2 library, identified as a reachable assertion, allows unauthenticated remote attackers to crash applications by sending malformed HTTP/2 frames.

The library fails to perform proper internal state validation when terminating a session, causing it to continue reading data and trigger an assertion failure upon receiving a malformed frame. This vulnerability is exploitable by unauthenticated remote attackers.

The exploitation of this vulnerability leads to an assertion failure, which forces the application process to terminate, resulting in a denial of service. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to service availability for any infrastructure relying on nghttp2 for HTTP/2 communications. Unplanned downtime can lead to substantial operational disruption and loss of business productivity.

Immediate Action: Update the nghttp2 library to version 1.68.1 or later to implement the necessary state validation logic.

Proactive Monitoring: Monitor server logs and application performance metrics for recurring process crashes or high frequencies of assertion-related error messages in the application runtime.

Compensating Controls: Deploy a Web Application Firewall or load balancer capable of inspecting and dropping malformed HTTP/2 traffic before it reaches the backend service.

Public Exploit Available: Yes — a proof-of-concept repository exists on GitHub.

Organizations utilizing nghttp2 should prioritize patching this vulnerability immediately. Because the flaw allows for unauthenticated remote denial of service, the risk to system availability is high. Upgrading to version 1.68.1 is the only reliable method to mitigate this risk, as no effective workarounds exist.