USN-8430-1: ADSys vulnerabilities
It was discovered that ADSys did not properly handle certain HTTP/2 frames. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-27141) It was discovered that ADSys did not properly handle certain HTTP/2 SETTINGS frames. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2026-33814)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/adsysto a version that resolves this vulnerability.Fixed in 0.16.4ubuntu1.1 - Upgrade
Upgrade
ubuntu/adsysto a version that resolves this vulnerability.Fixed in 0.16.3ubuntu0.25.10.2 - Upgrade
Upgrade
ubuntu/adsysto a version that resolves this vulnerability.Fixed in 0.16.3~24.04.2ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/adsysto a version that resolves this vulnerability.Fixed in 0.16.3~22.04.2ubuntu0.22.04.1 - Upgrade
Upgrade
ubuntu/adsysto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Frequently Asked Questions
Which systems are explicitly identified as affected by the HTTP/2 frame-handling issue?
The CVE-2026-27141 issue is explicitly stated to affect only Ubuntu 26.04 LTS. The provided data does not state a version limitation for CVE-2026-33814.
What access does an attacker need to exploit these issues?
Both issues are described as remotely exploitable. An attacker would need to send malformed or improperly handled HTTP/2 frames, including SETTINGS frames for CVE-2026-33814, to trigger a denial of service.
What is the expected impact if exploitation succeeds?
The stated impact is denial of service. The provided data does not claim code execution, privilege escalation, or data disclosure.