CVE-2026-58055
Fixed in a distro release EPSS <1%CVSS 5.4
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
Products: nghttp2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 10 | libnghttp2 | 1.68.0-3.el10_2.2 |
| AlmaLinux 10 | libnghttp2-devel | 1.68.0-3.el10_2.2 |
| AlmaLinux 10 | nghttp2 | 1.68.0-3.el10_2.2 |
| AlmaLinux 8 | libnghttp2 | 1.33.0-6.el8_10.3 |
| AlmaLinux 8 | libnghttp2-devel | 1.33.0-6.el8_10.3 |
| AlmaLinux 8 | nghttp2 | 1.33.0-6.el8_10.3 |
| AlmaLinux 9 | libnghttp2 | 1.43.0-6.el9_8.2 |
| AlmaLinux 9 | libnghttp2-devel | 1.43.0-6.el9_8.2 |
| AlmaLinux 9 | nghttp2 | 1.43.0-6.el9_8.2 |
| Alpine 3.24 | nghttp2 | 1.70.0-r0 |
| Chainguard | libnghttp2-14 | 1.70.0-r0 |
| Chainguard | nghttp2 | 1.70.0-r0 |
| Chainguard | nghttp2-dev | 1.70.0-r0 |
| Chainguard | nghttp2-doc | 1.70.0-r0 |
| Debian 12 | nghttp2 | no fix |
| Debian 13 | nghttp2 | no fix |
| Debian 14 | nghttp2 | 1.70.0-1 |
| Red Hat Enterprise Linux 10.2 | libnghttp2 | 0:1.68.0-3.el10_2.2 |
| Red Hat Enterprise Linux 10.2 | libnghttp2-debuginfo | 0:1.68.0-3.el10_2.2 |
| Red Hat Enterprise Linux 10.2 | libnghttp2-devel | 0:1.68.0-3.el10_2.2 |
| Red Hat Enterprise Linux 10.2 | nghttp2 | 0:1.68.0-3.el10_2.2 |
| Red Hat Enterprise Linux 10.2 | nghttp2-debuginfo | 0:1.68.0-3.el10_2.2 |
| Red Hat Enterprise Linux 10.2 | nghttp2-debugsource | 0:1.68.0-3.el10_2.2 |
| Red Hat Enterprise Linux 8 | libnghttp2 | 0:1.33.0-6.el8_10.3 |
| Red Hat Enterprise Linux 8 | libnghttp2-debuginfo | 0:1.33.0-6.el8_10.3 |
| Red Hat Enterprise Linux 8 | libnghttp2-devel | 0:1.33.0-6.el8_10.3 |
| Red Hat Enterprise Linux 8 | nghttp2 | 0:1.33.0-6.el8_10.3 |
| Red Hat Enterprise Linux 8 | nghttp2-debuginfo | 0:1.33.0-6.el8_10.3 |
| Red Hat Enterprise Linux 8 | nghttp2-debugsource | 0:1.33.0-6.el8_10.3 |
| Red Hat Enterprise Linux 9 | libnghttp2 | 0:1.43.0-6.el9_8.2 |
| Red Hat Enterprise Linux 9 | libnghttp2-debuginfo | 0:1.43.0-6.el9_8.2 |
| Red Hat Enterprise Linux 9 | libnghttp2-devel | 0:1.43.0-6.el9_8.2 |
| Red Hat Enterprise Linux 9 | nghttp2 | 0:1.43.0-6.el9_8.2 |
| Red Hat Enterprise Linux 9 | nghttp2-debuginfo | 0:1.43.0-6.el9_8.2 |
| Red Hat Enterprise Linux 9 | nghttp2-debugsource | 0:1.43.0-6.el9_8.2 |
| Red Hat hummingbird 1 | curl | 0:8.21.0-0.1.1.hum1 |
| Red Hat hummingbird 1 | libcurl | 0:8.21.0-0.1.1.hum1 |
| Red Hat hummingbird 1 | libcurl-devel | 0:8.21.0-0.1.1.hum1 |
| Red Hat hummingbird 1 | libcurl-minimal | 0:8.21.0-0.1.1.hum1 |
| Red Hat hummingbird 1 | libnghttp2 | 0:1.69.0-5.hum1 |
| Red Hat hummingbird 1 | libnghttp2 | 0:1.69.0-3.1.hum1 |
| Red Hat hummingbird 1 | libnghttp2-devel | 0:1.69.0-5.hum1 |
| Red Hat hummingbird 1 | libnghttp2-devel | 0:1.69.0-3.1.hum1 |
| Red Hat hummingbird 1 | mingw32-libnghttp2 | 0:1.69.0-5.hum1 |
| Red Hat hummingbird 1 | mingw32-libnghttp2 | 0:1.69.0-3.1.hum1 |
| Red Hat hummingbird 1 | mingw64-libnghttp2 | 0:1.69.0-5.hum1 |
| Red Hat hummingbird 1 | mingw64-libnghttp2 | 0:1.69.0-3.1.hum1 |
| Red Hat hummingbird 1 | nghttp2 | 0:1.69.0-5.hum1 |
| Red Hat hummingbird 1 | nghttp2 | 0:1.69.0-3.1.hum1 |
| Rocky Linux 10 | nghttp2 | 0:1.68.0-3.el10_2.2 |
| Rocky Linux 8 | nghttp2 | 0:1.33.0-6.el8_10.3 |
| Rocky Linux 9 | nghttp2 | 0:1.43.0-6.el9_8.2 |
| SUSE Linux Enterprise Micro 5.3 | nghttp2 | 1.40.0-150200.25.1 |
| SUSE Linux Enterprise Micro 5.4 | nghttp2 | 1.40.0-150200.25.1 |
| SUSE Linux Enterprise Micro 5.5 | nghttp2 | 1.40.0-150200.25.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | nghttp2 | 1.64.0-150700.3.6.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | nghttp2 | 1.40.0-150600.25.8.1 |
| SUSE Linux Enterprise Server 16.0 | nghttp2 | 1.64.0-160000.4.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | nghttp2 | 1.39.2-3.26.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | nghttp2 | 1.64.0-160000.4.1 |
| SUSE Linux Micro 6.0 | nghttp2 | 1.52.0-7.1 |
| SUSE Linux Micro 6.1 | nghttp2 | 1.52.0-slfo.1.1_3.1 |
| SUSE Linux Micro 6.2 | nghttp2 | 1.64.0-160000.4.1 |
| Ubuntu 22.04 LTS | nghttp2 | 1.43.0-1ubuntu0.4 |
| Ubuntu 24.04 LTS | nghttp2 | 1.59.0-1ubuntu0.4 |
| Ubuntu 25.10 | nghttp2 | 1.64.0-1.1ubuntu1.2 |
| Ubuntu 26.04 LTS | nghttp2 | 1.68.0-2ubuntu0.2 |
| Ubuntu Pro 16.04 LTS | nghttp2 | no fix |
| Ubuntu Pro 18.04 LTS | nghttp2 | no fix |
| Ubuntu Pro 20.04 LTS | nghttp2 | no fix |
| Wolfi | libnghttp2-14 | 1.70.0-r0 |
| Wolfi | nghttp2 | 1.70.0-r0 |
| Wolfi | nghttp2-dev | 1.70.0-r0 |
| Wolfi | nghttp2-doc | 1.70.0-r0 |
| openSUSE Leap 16.0 | nghttp2 | 1.64.0-160000.4.1 |
| openSUSE Tumbleweed | nghttp2 | 1.69.0-2.1 |