nghttp2 contains an assertion failure vulnerability caused by missing internal state validation after the library’s session termination API is invoked. This flaw permits an attacker to send a crafted HTTP/2 frame that triggers a FRAME_SIZE_ERROR condition, ultimately leading the library to assert and crash. The root weakness is improper input validation, classified as CWE‑617. When triggered, the service using nghttp2 experiences a denial of service because the thread or process handling the connection terminates unexpectedly.

The vulnerability affects the nghttp2 implementation of HTTP/2, specifically all releases prior to version 1.68.1. Any deployment that relies on nghttp2 1.68.0 or earlier is exposed. The products involved are the nghttp2 library exposed through its public APIs nghttp2_session_terminate_session and nghttp2_session_terminate_session2.

The CVSS score of 7.5 indicates a high impact on availability. Although the EPSS probability is low (<1 %) and the issue is not listed in the CISA KEV catalog, the potential for denial of service remains significant for services that have no fail‑over or do not handle unexpected crashes gracefully. The absence of a workaround means the only defense is to update to a version that includes the missing state validation, namely 1.68.1 or later. Attackers would need network access to target the application using nghttp2; once they send the malformed frame, the session terminates and the application cannot recover until restarted.