-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 15 Apr 2026 16:23:22 +0200
Source: nghttp2
Binary: libnghttp2-doc nghttp2
Architecture: all
Version: 1.52.0-1+deb12u3
Distribution: bookworm-security
Urgency: high
Maintainer: all Build Daemon (x86-csail-02) <buildd_all-x86-csail-02@buildd.debian.org>
Changed-By: Lukas Märdian <slyon@debian.org>
Description:
 libnghttp2-doc - library implementing HTTP/2 protocol (documentation)
 nghttp2    - server, proxy and client implementing HTTP/2
Closes: 1131369
Changes:
 nghttp2 (1.52.0-1+deb12u3) bookworm-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-27135 (Closes: #1131369)
     Fix missing iframe->state validations to avoid assertion failure.
   * Add test for CVE-2026-27135 (cherry-picked from upstream c619c7b)
Checksums-Sha1:
 49d0454079b7f9239c446ddbfbc096bc44e7a527 2974236 libnghttp2-doc_1.52.0-1+deb12u3_all.deb
 848eb4a25451541ea5d1a847552f701750825139 8558 nghttp2_1.52.0-1+deb12u3_all-buildd.buildinfo
 1f172778091877966ad5ef421fb5fe85157923fa 8812 nghttp2_1.52.0-1+deb12u3_all.deb
Checksums-Sha256:
 837b2021d05d6ca274aba088f280ee8503858e42e35ccd1bab9bc9a8a7b93b70 2974236 libnghttp2-doc_1.52.0-1+deb12u3_all.deb
 281f3e51c238c8fbbfffebd51c899b460b804eaedc961f815a4c0bff42c77959 8558 nghttp2_1.52.0-1+deb12u3_all-buildd.buildinfo
 44fbbfb1797302e300c161c655dffff13092e2f259b61abeb65850fac2e6cf62 8812 nghttp2_1.52.0-1+deb12u3_all.deb
Files:
 9b3c18d05727edb9aae8b043815d6d44 2974236 doc optional libnghttp2-doc_1.52.0-1+deb12u3_all.deb
 f953204d6b3bc6b0c769ecd62b38d89b 8558 httpd optional nghttp2_1.52.0-1+deb12u3_all-buildd.buildinfo
 86b80556e52c335cc982195b83b44df3 8812 httpd optional nghttp2_1.52.0-1+deb12u3_all.deb

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXLxUpUHQBQBTDtd4aBVi67oXtfkFAmoEbiwACgkQaBVi67oX
tfm/8xAAs89WnvquqToJfryz0uIKLVOV6PJfuEafkDoPldGh0pnxTn//KDLnH+JB
niD43TIQTJHwPfYumBQw42gTEMi9gckAXJv2qAkEul21n+QgIH+gLVRqIcu4Ei3S
rbAX/KzXWzmccXVvGHK1lZjBaLn3aEjaUMKe3jTCDJDcttVWw3S+E0cEAABfIhBO
fmNz0YiAGdNZJoo4OPPrmhCWrLMgaAYl2qcAC5+mBJyRuT2FII2jYo1kKugWZHGS
G23DaHmxr3UrrEq5LBVANLOj+FrrwGdP4q9FH2QhM5uXtNO8D5O3ADyrcUtk30GY
awPB7BvKlM8/p1dEjNlo7kJ51XuytKrROeZ0gY9SfAiLrWjJgy90BEQN21BqsK32
2z55ZqdW/BrzKzi6PSg0/LB6Ab8kGorX5v1M7xeMwDS1s0H9B1wcQ2BjPAN98nvI
5wmcamE+dRoXF64lUcK9OMeFvjgTt5SlApAxD25abUrfpnlRokb96ZvxS/1E45Si
OKpP+phudHx3z/ZvZDlmBcJFq4GR0wxH8tEkEGAnJSafP4Uegy85g7/rTxa/n9PA
dfn4qCkaDwpPLm9fDGgEfjx79v1Fb6nM6MYheIEoZLeZdbyfaO3KwmMKxtvfnF5s
TJgVa+WvaPQ9d+Lw40Qkzzl1vuXUHdUkidBbLJwPMugvrSK41Ao=
=Rp9/
-----END PGP SIGNATURE-----