Accepted nghttp2 1.64.0-1.1+deb13u1 (source) into proposed-updates

Debian FTP Masters <[email protected]> Sat, 16 May 2026 19:32:52 +0000

Newsgroups	gmane.linux.debian.devel.changes.stable
Message-ID	<[email protected]>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 15 Apr 2026 17:04:15 +0200
Source: nghttp2
Architecture: source
Version: 1.64.0-1.1+deb13u1
Distribution: trixie-security
Urgency: medium
Maintainer: Tomasz Buchert <[email protected]>
Changed-By: Lukas Märdian <[email protected]>
Closes: 1131369
Changes:
 nghttp2 (1.64.0-1.1+deb13u1) trixie-security; urgency=medium
 .
   * Non-maintainer upload by the Security Team.
   * CVE-2026-27135 (Closes: #1131369)
     Fix missing iframe->state validations to avoid assertion failure.
   * Add test for CVE-2026-27135 (cherry-picked from upstream c619c7b)
Checksums-Sha1:
 2bace9a54aa2669f85232c8967da5895d06e9127 2201 nghttp2_1.64.0-1.1+deb13u1.dsc
 422ab3102d4d22ff363fbababe9f66e2ae38db45 1069782 nghttp2_1.64.0.orig.tar.gz
 3edbadb61b38b529ba29b86c566523d8f778c36d 42120 nghttp2_1.64.0-1.1+deb13u1.debian.tar.xz
 ae6aebd23ed337656be8bbbf9827bfc6681c51c1 5999 nghttp2_1.64.0-1.1+deb13u1_source.buildinfo
Checksums-Sha256:
 11f4603a9f417bc3d195be36cb462bb9df0657f52b72dd9276453a31bc0227c7 2201 nghttp2_1.64.0-1.1+deb13u1.dsc
 b452dc69a1fcbc9375389b8b154175d8b7b125cdd713fc426774c2b79a1ebd77 1069782 nghttp2_1.64.0.orig.tar.gz
 e16478701c5c007aa8761dc30c01090b2217199558bd1017b1d237db463d758c 42120 nghttp2_1.64.0-1.1+deb13u1.debian.tar.xz
 c8de19cabf5ffc01984ac11f3cbdf605b81946e4a9347859b01db6ec539a0dc0 5999 nghttp2_1.64.0-1.1+deb13u1_source.buildinfo
Files:
 88930e7f6370ca921c65239fdf5b0807 2201 httpd optional nghttp2_1.64.0-1.1+deb13u1.dsc
 a4c2bb361820eedd872af2a4192070b7 1069782 httpd optional nghttp2_1.64.0.orig.tar.gz
 d3feb46ee34764f33cda071b42ba46f0 42120 httpd optional nghttp2_1.64.0-1.1+deb13u1.debian.tar.xz
 77df3490bc876015032c4c557c95c61a 5999 httpd optional nghttp2_1.64.0-1.1+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmoEZCkACgkQ+GQ1dHE8
m67EPAgAnBi9BFFN1PM861wDhbVTTARhWm6qJzrnaPgosI2eeOt9vCqsBkQFvE14
PX/EBAppuctrWBlvbYQi7qWU0wvbV/VcOyMTFuu1rSGN7D/Cu/gZE5HctHeiDUt3
oRVVshk5ejKqNVIA/b2pj6TAN7oGUVe6fwVRiC0MvrL4QWwvdoHYV36zEssJPOLX
7MNuSlLPzKSN4XUvRoEw+Nk46ZZmHLGzCNk/Mmb7EU+rcpGdt5RQHXqJrgq5SpP3
a0JEF9hFV0ICwzwRUTZGdLO4uP2yVXAz/Sfj/XwjJG7yj//HfTvbpos8dpnz91rL
+S2JrSUKLlQGdlySrpS68MduVin8Ag==
=PvmV
-----END PGP SIGNATURE-----

signature.asc (application/pgp-signature, 228 B)