Skip to content

fix(docker): address CVE-2026-27135 nghttp2-libs vulnerability#10879

Merged
robert-hebel-sb merged 1 commit into
masterfrom
fix/cve-2026-27135-nghttp2-libs
May 12, 2026
Merged

fix(docker): address CVE-2026-27135 nghttp2-libs vulnerability#10879
robert-hebel-sb merged 1 commit into
masterfrom
fix/cve-2026-27135-nghttp2-libs

Conversation

@robert-hebel-sb
Copy link
Copy Markdown
Contributor

@robert-hebel-sb robert-hebel-sb commented May 12, 2026 •
edited
Loading

Summary

  • Pins nghttp2-libs to >=1.68.1-r0 in the Dockerfile to fix HIGH severity CVE-2026-27135
  • Vulnerability: Denial of Service via malformed HTTP/2 frames after session termination
  • Detected by Trivy in the docker.swagger.io/swaggerapi/swagger-ui:unstable image (Alpine 3.23.4)
  • Follows the same pattern already used in the Dockerfile for other pinned Alpine packages

How Has This Been Tested?

  • The fix will be validated by the next scheduled Trivy Docker image security scan
  • No functional code changes; only the Alpine package version constraint is updated

Screenshots

N/A — no UI changes

🤖 Generated with Claude Code

@robert-hebel-sb @claude
fix(docker): address CVE-2026-27135 nghttp2-libs vulnerability
3c0a58d 
Pin nghttp2-libs to >=1.68.1-r0 in Docker image to fix HIGH severity
CVE-2026-27135 (DoS via malformed HTTP/2 frames after session termination).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@robert-hebel-sb robert-hebel-sb merged commit 0a63415 into master May 12, 2026
9 checks passed
swagger-bot pushed a commit that referenced this pull request May 12, 2026
@semantic-release-bot
chore(release): cut the 5.32.6 release
dcdca62 
## [5.32.6](v5.32.5...v5.32.6) (2026-05-12)

### Bug Fixes

* **deps-dev:** address undici vulnerability ([#10870](#10870)) ([35f5a6a](35f5a6a))
* **docker:** address CVE-2026-27135 nghttp2-libs vulnerability ([#10879](#10879)) ([0a63415](0a63415))
@swagger-bot
Copy link
Copy Markdown
Contributor

swagger-bot commented May 12, 2026

🎉 This PR is included in version 5.32.6 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@glowcloud glowcloud glowcloud approved these changes

@cka121 cka121 Awaiting requested review from cka121

Assignees

No one assigned

Labels

released

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@robert-hebel-sb @swagger-bot @glowcloud