Every CVE Search/ Get API key

CVE-2026-58055

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

6.3 MediumFix available

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.25%Up 0.1 points since Jun 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
CVE-2026-58055
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2026-39975 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
EUVD-2026-39975
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-xrr7-82jr-v58x 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
GHSA-xrr7-82jr-v58x
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
NVD 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
CVE-2026-58055
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2026-58055 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
ALPINE-CVE-2026-58055
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2026-58055 5.4
Record
BELL-CVE-2026-58055
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 37 moreShow less
OSV 6.3

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
CVE-2026-58055
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Weakness
CWE-444
Updated
2026-11-02
OSVDEBIAN-CVE-2026-58055 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
DEBIAN-CVE-2026-58055
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVJLSEC-2026-1157 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
JLSEC-2026-1157
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2977 5.4

nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.

Security Fix(es):

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)

Record
OESA-2026-2977
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2978 5.4

nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.

Security Fix(es):

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)

Record
OESA-2026-2978
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2979 5.4

nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.

Security Fix(es):

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)

Record
OESA-2026-2979
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2026-2980 5.4

nghttp2 security update

The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.

Security Fix(es):

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)

Record
OESA-2026-2980
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:35454 5.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:35454
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:41240 7.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:41240
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:52414 5.4

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:52414
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:54650 5.4

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:54650
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:54662 5.4

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:54662
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2026:55804 5.4

Red Hat Security Advisory: nghttp2 security update

Record
RHSA-2026:55804
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:54650 5.4

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54650
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:54662 5.4

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:54662
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRLSA-2026:55804 5.4

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:55804
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-58055 6.3

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
UBUNTU-CVE-2026-58055
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVALSA-2026:54650 No score

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54650
Updated
2026-11-02
OSVALSA-2026:54662 No score

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:54662
Updated
2026-11-02
OSVALSA-2026:55804 No score

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:55804
Updated
2026-11-02
OSVAZL-91451 No score

CVE-2026-58055 affecting package fluent-bit for versions less than 3.1.10-6

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Record
AZL-91451
Updated
2026-11-05
OSVCLSA-2026-1787308423 No score

nghttp2: Fix of CVE-2026-58055

  • CVE-2026-58055: reject Upgrade/CONNECT requests carrying a body and stop forwarding them onto reusable keep-alive backend connections
Record
CLSA-2026-1787308423
Updated
2026-11-02
OSVCLSA-2026-1787754280 No score

nghttp2: Fix of CVE-2026-58055

  • CVE-2026-58055: fix HTTP request/response smuggling via HTTP/1.1 Upgrade request with Content-Length
Record
CLSA-2026-1787754280
Updated
2026-11-02
OSVMGASA-2026-0309 No score

Updated nghttp2 packages fix a security vulnerability

The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. (CVE-2026-58055)

Record
MGASA-2026-0309
Updated
2026-11-02
OSVopenSUSE-SU-2026:11156-1 No score

libnghttp2-14-1.69.0-2.1 on GA media

These are all security issues fixed in the libnghttp2-14-1.69.0-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11156-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21302-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length (bsc#1269489).
Record
openSUSE-SU-2026:21302-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-58055 No score

CVE-2026-58055 in nghttp2 - Patched by Root

Root has patched CVE-2026-58055 in the nghttp2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-58055
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-58055 No score

CVE-2026-58055 in nghttp2 - Patched by Root

Root has patched CVE-2026-58055 in the nghttp2 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-58055
Updated
2026-11-02
OSVSUSE-SU-2026:22594-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length (bsc#1269489).
Record
SUSE-SU-2026:22594-1
Updated
2026-11-02
OSVSUSE-SU-2026:22630-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length (bsc#1269489).
Record
SUSE-SU-2026:22630-1
Updated
2026-11-02
OSVSUSE-SU-2026:22707-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length (bsc#1269489).
Record
SUSE-SU-2026:22707-1
Updated
2026-11-02
OSVSUSE-SU-2026:22893-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length (bsc#1269489).
Record
SUSE-SU-2026:22893-1
Updated
2026-11-02
OSVSUSE-SU-2026:2883-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning (bsc#1269489).
Record
SUSE-SU-2026:2883-1
Updated
2026-11-02
OSVSUSE-SU-2026:3153-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning (bsc#1269489).
Record
SUSE-SU-2026:3153-1
Updated
2026-11-02
OSVSUSE-SU-2026:3154-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue

  • CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning (bsc#1269489).
Record
SUSE-SU-2026:3154-1
Updated
2026-11-02
OSVSUSE-SU-2026:4029-1 No score

Security update for nghttp2

This update for nghttp2 fixes the following issue:

  • CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning (bsc#1269489).
Record
SUSE-SU-2026:4029-1
Updated
2026-11-02
OSVUSN-8495-1 No score

nghttp2 vulnerability

It was discovered that the nghttp2 nghttpx proxy incorrectly handled HTTP/1.1 Upgrade requests that included a Content-Length header and body. A remote attacker could possibly use this issue to perform HTTP request and response smuggling attacks against backend services.

Record
USN-8495-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nghttp2
Alpine:v3.24
 before 1.70.0-r0
1.70.0-r0
libnghttp2
AlmaLinux:10
 before 1.68.0-3.el10_2.2
1.68.0-3.el10_2.2
libnghttp2-devel
AlmaLinux:10
 before 1.68.0-3.el10_2.2
1.68.0-3.el10_2.2
nghttp2
AlmaLinux:10
 before 1.68.0-3.el10_2.2
1.68.0-3.el10_2.2
libnghttp2
AlmaLinux:9
 before 1.43.0-6.el9_8.2
1.43.0-6.el9_8.2
libnghttp2-devel
AlmaLinux:9
 before 1.43.0-6.el9_8.2
1.43.0-6.el9_8.2
nghttp2
AlmaLinux:9
 before 1.43.0-6.el9_8.2
1.43.0-6.el9_8.2
libnghttp2
AlmaLinux:8
 before 1.33.0-6.el8_10.3
1.33.0-6.el8_10.3
libnghttp2-devel
AlmaLinux:8
 before 1.33.0-6.el8_10.3
1.33.0-6.el8_10.3
nghttp2
AlmaLinux:8
 before 1.33.0-6.el8_10.3
1.33.0-6.el8_10.3
Show 88 moreShow less
Affected packages
PackageAffectedFixed
fluent-bit
Azure Linux:3
 before 3.1.10-6
3.1.10-6
nghttp2
Alpaquita:25
 1.65.0-r0 up to 1.69.0-r1
1.69.0-r1
nghttp2
Alpaquita:stream
 1.52.0-r0 up to 1.70.0-r0
1.70.0-r0
nghttp2
BellSoft Hardened Containers:25
 1.65.0-r0 up to 1.69.0-r1
1.69.0-r1
nghttp2
BellSoft Hardened Containers:stream
 1.52.0-r0 up to 1.70.0-r0
1.70.0-r0
libnghttp2
TuxCare:AlmaLinux:9.6
 before 1.43.0-6.el9_6.tuxcare.els3
1.43.0-6.el9_6.tuxcare.els3
libnghttp2-devel
TuxCare:AlmaLinux:9.6
 before 1.43.0-6.el9_6.tuxcare.els3
1.43.0-6.el9_6.tuxcare.els3
nghttp2
TuxCare:AlmaLinux:9.6
 before 1.43.0-6.el9_6.tuxcare.els3
1.43.0-6.el9_6.tuxcare.els3
libnghttp2
TuxCare:AlmaLinux:9.2
 before 1.43.0-5.el9_2.1.tuxcare.els3
1.43.0-5.el9_2.1.tuxcare.els3
libnghttp2-devel
TuxCare:AlmaLinux:9.2
 before 1.43.0-5.el9_2.1.tuxcare.els3
1.43.0-5.el9_2.1.tuxcare.els3
nghttp2
TuxCare:AlmaLinux:9.2
 before 1.43.0-5.el9_2.1.tuxcare.els3
1.43.0-5.el9_2.1.tuxcare.els3
nghttp2
Debian:12
 All versions, plus listed versions
1.52.0-11.52.0-1+deb12u11.52.0-1+deb12u21.52.0-1+deb12u31.53.0-1
Show 18 moreShow less
1.54.0-11.55.1-11.56.0-11.57.0-11.58.0-11.59.0-11.60.0-11.61.0-11.62.1-11.62.1-21.63.0-11.64.0-11.64.0-1.11.68.0-11.68.0-21.68.1-11.69.0-11.70.0-1
 None known
nghttp2
Debian:13
 All versions, plus listed versions
1.64.0-1.11.64.0-1.1+deb13u11.68.0-11.68.0-21.68.1-11.69.0-11.70.0-1
 None known
nghttp2
Debian:14
 before 1.70.0-1, plus listed versions
1.64.0-1.11.68.0-11.68.0-21.68.1-11.69.0-1
1.70.0-1
nghttp2_jll
Julia
 before 1.70.0+0
1.70.0+0
nghttp2
Mageia:10
 before 1.68.1-2.1.mga10
1.68.1-2.1.mga10
nghttp2
Mageia:9
 before 1.61.0-1.2.mga9
1.61.0-1.2.mga9
nghttp2
openEuler:20.03-LTS-SP4
 before 1.41.0-8.oe2003sp4
1.41.0-8.oe2003sp4
nghttp2
openEuler:22.03-LTS-SP4
 before 1.46.0-8.oe2203sp4
1.46.0-8.oe2203sp4
nghttp2
openEuler:24.03-LTS-SP1
 before 1.58.0-4.oe2403sp1
1.58.0-4.oe2403sp1
nghttp2
openEuler:24.03-LTS-SP3
 before 1.58.0-4.oe2403sp3
1.58.0-4.oe2403sp3
libnghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-3.1.hum1
0:1.69.0-3.1.hum1
libnghttp2-devel
Red Hat:hummingbird:1
 before 0:1.69.0-3.1.hum1
0:1.69.0-3.1.hum1
mingw32-libnghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-3.1.hum1
0:1.69.0-3.1.hum1
mingw64-libnghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-3.1.hum1
0:1.69.0-3.1.hum1
nghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-3.1.hum1
0:1.69.0-3.1.hum1
curl
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:8.21.0-0.1.1.hum1
0:8.21.0-0.1.1.hum1
libcurl
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:8.21.0-0.1.1.hum1
0:8.21.0-0.1.1.hum1
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:8.21.0-0.1.1.hum1
0:8.21.0-0.1.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 3 CVEs
 before 0:8.21.0-0.1.1.hum1
0:8.21.0-0.1.1.hum1
libnghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-5.hum1
0:1.69.0-5.hum1
libnghttp2-devel
Red Hat:hummingbird:1
 before 0:1.69.0-5.hum1
0:1.69.0-5.hum1
mingw32-libnghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-5.hum1
0:1.69.0-5.hum1
mingw64-libnghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-5.hum1
0:1.69.0-5.hum1
nghttp2
Red Hat:hummingbird:1
 before 0:1.69.0-5.hum1
0:1.69.0-5.hum1
libnghttp2-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
libnghttp2-devel
Red Hat:enterprise_linux:10.2
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
nghttp2-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
nghttp2-debugsource
Red Hat:enterprise_linux:10.2
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
libnghttp2
Red Hat:enterprise_linux:10.2
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
nghttp2
Red Hat:enterprise_linux:10.2
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
libnghttp2
Red Hat:enterprise_linux:9::baseos
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
libnghttp2-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2
Red Hat:enterprise_linux:9::baseos
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2-debuginfo
Red Hat:enterprise_linux:9::baseos
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2-debugsource
Red Hat:enterprise_linux:9::baseos
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
libnghttp2-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
libnghttp2-devel
Red Hat:enterprise_linux:9::crb
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2
Red Hat:enterprise_linux:9::crb
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2-debuginfo
Red Hat:enterprise_linux:9::crb
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2-debugsource
Red Hat:enterprise_linux:9::crb
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
libnghttp2
Red Hat:enterprise_linux:8::baseos
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
libnghttp2-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2
Red Hat:enterprise_linux:8::baseos
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
libnghttp2-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
libnghttp2-devel
Red Hat:enterprise_linux:8::crb
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2
Red Hat:enterprise_linux:8::crb
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2
Rocky Linux:10
 before 0:1.68.0-3.el10_2.2
0:1.68.0-3.el10_2.2
nghttp2
Rocky Linux:9
 before 0:1.43.0-6.el9_8.2
0:1.43.0-6.el9_8.2
nghttp2
Rocky Linux:8
 before 0:1.33.0-6.el8_10.3
0:1.33.0-6.el8_10.3
nghttp2
Root:Debian:12
 before 1.52.0-1+deb12u3.aikido.2
1.52.0-1+deb12u3.aikido.21.52.0-1+deb12u3.aikido.3
rootio-nghttp2
Root:Debian:12
 before 1.52.0-1+deb12u3.aikido.2
1.52.0-1+deb12u3.aikido.21.52.0-1+deb12u3.aikido.3
nghttp2
Root:Debian:13
 before 1.64.0-1.1+deb13u1.aikido.2
1.64.0-1.1+deb13u1.aikido.21.64.0-1.1+deb13u1.aikido.3
rootio-nghttp2
Root:Debian:13
 before 1.64.0-1.1+deb13u1.aikido.2
1.64.0-1.1+deb13u1.aikido.21.64.0-1.1+deb13u1.aikido.3
nghttp2
SUSE:Linux Micro 6.2
 before 1.64.0-160000.4.1
1.64.0-160000.4.1
nghttp2
SUSE:Linux Enterprise Server 16.0
 before 1.64.0-160000.4.1
1.64.0-160000.4.1
nghttp2
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.64.0-160000.4.1
1.64.0-160000.4.1
nghttp2
SUSE:Linux Micro 6.0
 before 1.52.0-7.1
1.52.0-7.1
nghttp2
SUSE:Linux Micro 6.1
 before 1.52.0-slfo.1.1_3.1
1.52.0-slfo.1.1_3.1
nghttp2
SUSE:Linux Enterprise Micro 5.3
 before 1.40.0-150200.25.1
1.40.0-150200.25.1
nghttp2
SUSE:Linux Enterprise Micro 5.4
 before 1.40.0-150200.25.1
1.40.0-150200.25.1
nghttp2
SUSE:Linux Enterprise Micro 5.5
 before 1.40.0-150200.25.1
1.40.0-150200.25.1
nghttp2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.40.0-150600.25.8.1
1.40.0-150600.25.8.1
nghttp2
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.39.2-3.26.1
1.39.2-3.26.1
nghttp2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.64.0-150700.3.6.1
1.64.0-150700.3.6.1
nghttp2
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.6.7-11.3.4-21.4.0-11.4.0-21.5.0-2
Show 6 moreShow less
1.6.0-11.7.0-11.7.1-11.7.1-1ubuntu0.1~esm11.7.1-1ubuntu0.1~esm21.7.1-1ubuntu0.1~esm3
 None known
nghttp2
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.25.0-11.27.0-11.28.0-11.29.0-11.29.0-1build1
Show 5 moreShow less
1.30.0-11.30.0-1ubuntu11.30.0-1ubuntu1+esm11.30.0-1ubuntu1+esm21.30.0-1ubuntu1+esm3
 None known
nghttp2
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.39.2-11.40.0-11.40.0-1build11.40.0-1ubuntu0.11.40.0-1ubuntu0.21.40.0-1ubuntu0.31.40.0-1ubuntu0.3+esm1
 None known
nghttp2
Ubuntu:22.04:LTS
 before 1.43.0-1ubuntu0.4, plus listed versions
1.43.0-11.43.0-1build11.43.0-1build21.43.0-1build31.43.0-1ubuntu0.11.43.0-1ubuntu0.21.43.0-1ubuntu0.3
1.43.0-1ubuntu0.4
nghttp2
Ubuntu:24.04:LTS
 before 1.59.0-1ubuntu0.4, plus listed versions
1.55.1-11.57.0-11.58.0-11.59.0-11.59.0-1build1
Show 5 moreShow less
1.59.0-1build21.59.0-1build41.59.0-1ubuntu0.11.59.0-1ubuntu0.21.59.0-1ubuntu0.3
1.59.0-1ubuntu0.4
nghttp2
Ubuntu:25.10
 before 1.64.0-1.1ubuntu1.2, plus listed versions
1.64.0-1ubuntu11.64.0-1.11.64.0-1.1build11.64.0-1.1ubuntu11.64.0-1.1ubuntu1.1
1.64.0-1.1ubuntu1.2
nghttp2
Ubuntu:26.04:LTS
 before 1.68.0-2ubuntu0.2, plus listed versions
1.64.0-1.1ubuntu11.64.0-1.1ubuntu21.68.0-11.68.0-21.68.0-2ubuntu0.1
1.68.0-2ubuntu0.2
nghttp2
openSUSE:Tumbleweed
 before 1.69.0-2.1
1.69.0-2.1
nghttp2
openSUSE:Leap 16.0
 before 1.64.0-160000.4.1
1.64.0-160000.4.1

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-58055 is a medium vulnerability (CVSS 6.3) in Nghttp2, published June 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in nghttp2 1.70.0-r0.

References

Show 61 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open