{"id":"CVE-2026-58055","aliases":["ALPINE-CVE-2026-58055","ALSA-2026:54650","ALSA-2026:54662","ALSA-2026:55804","AZL-91451","BELL-CVE-2026-58055","CLSA-2026-1787308423","CLSA-2026-1787754280","DEBIAN-CVE-2026-58055","EUVD-2026-39975","GHSA-xrr7-82jr-v58x","JLSEC-2026-1157","MGASA-2026-0309","OESA-2026-2977","OESA-2026-2978","OESA-2026-2979","OESA-2026-2980","RHSA-2026:35454","RHSA-2026:41240","RHSA-2026:52414","RHSA-2026:54650","RHSA-2026:54662","RHSA-2026:55804","RLSA-2026:54650","RLSA-2026:54662","RLSA-2026:55804","ROOT-OS-DEBIAN-12-CVE-2026-58055","ROOT-OS-DEBIAN-13-CVE-2026-58055","SUSE-SU-2026:22594-1","SUSE-SU-2026:22630-1","SUSE-SU-2026:22707-1","SUSE-SU-2026:22893-1","SUSE-SU-2026:2883-1","SUSE-SU-2026:3153-1","SUSE-SU-2026:3154-1","SUSE-SU-2026:4029-1","UBUNTU-CVE-2026-58055","USN-8495-1","openSUSE-SU-2026:11156-1","openSUSE-SU-2026:21302-1"],"status":"published","title":"nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00253,"percentile":0.16966,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2026-06-28T01:32:57Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"nghttp2","fixed_in":["1.70.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libnghttp2","fixed_in":["1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libnghttp2-devel","fixed_in":["1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"nghttp2","fixed_in":["1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libnghttp2","fixed_in":["1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libnghttp2-devel","fixed_in":["1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"nghttp2","fixed_in":["1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libnghttp2","fixed_in":["1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libnghttp2-devel","fixed_in":["1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"nghttp2","fixed_in":["1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"fluent-bit","fixed_in":["3.1.10-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nghttp2","fixed_in":["1.69.0-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nghttp2","fixed_in":["1.70.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nghttp2","fixed_in":["1.69.0-r1"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nghttp2","fixed_in":["1.70.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnghttp2","fixed_in":["1.43.0-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnghttp2-devel","fixed_in":["1.43.0-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nghttp2","fixed_in":["1.43.0-6.el9_6.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnghttp2","fixed_in":["1.43.0-5.el9_2.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnghttp2-devel","fixed_in":["1.43.0-5.el9_2.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nghttp2","fixed_in":["1.43.0-5.el9_2.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nghttp2","fixed_in":["1.70.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"nghttp2_jll","fixed_in":["1.70.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"nghttp2","fixed_in":["1.68.1-2.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"nghttp2","fixed_in":["1.61.0-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nghttp2","fixed_in":["1.41.0-8.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nghttp2","fixed_in":["1.46.0-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nghttp2","fixed_in":["1.58.0-4.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"nghttp2","fixed_in":["1.58.0-4.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libnghttp2","fixed_in":["0:1.69.0-3.1.hum1","0:1.69.0-5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"libnghttp2-devel","fixed_in":["0:1.69.0-3.1.hum1","0:1.69.0-5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"mingw32-libnghttp2","fixed_in":["0:1.69.0-3.1.hum1","0:1.69.0-5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"mingw64-libnghttp2","fixed_in":["0:1.69.0-3.1.hum1","0:1.69.0-5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"nghttp2","fixed_in":["0:1.69.0-3.1.hum1","0:1.69.0-5.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnghttp2-debuginfo","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnghttp2-devel","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"nghttp2-debuginfo","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"nghttp2-debugsource","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnghttp2","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"nghttp2","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libnghttp2","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libnghttp2-debuginfo","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nghttp2","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nghttp2-debuginfo","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nghttp2-debugsource","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnghttp2-debuginfo","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnghttp2-devel","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nghttp2","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nghttp2-debuginfo","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nghttp2-debugsource","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-debuginfo","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-devel","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debuginfo","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debugsource","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"nghttp2","fixed_in":["0:1.68.0-3.el10_2.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"nghttp2","fixed_in":["0:1.43.0-6.el9_8.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"nghttp2","fixed_in":["0:1.33.0-6.el8_10.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"nghttp2","fixed_in":["1.52.0-1+deb12u3.aikido.2","1.52.0-1+deb12u3.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-nghttp2","fixed_in":["1.52.0-1+deb12u3.aikido.2","1.52.0-1+deb12u3.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"nghttp2","fixed_in":["1.64.0-1.1+deb13u1.aikido.2","1.64.0-1.1+deb13u1.aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-nghttp2","fixed_in":["1.64.0-1.1+deb13u1.aikido.2","1.64.0-1.1+deb13u1.aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"nghttp2","fixed_in":["1.64.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nghttp2","fixed_in":["1.64.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nghttp2","fixed_in":["1.64.0-160000.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"nghttp2","fixed_in":["1.52.0-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"nghttp2","fixed_in":["1.52.0-slfo.1.1_3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"nghttp2","fixed_in":["1.40.0-150200.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"nghttp2","fixed_in":["1.40.0-150200.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"nghttp2","fixed_in":["1.40.0-150200.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"nghttp2","fixed_in":["1.40.0-150600.25.8.1","1.64.0-150700.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nghttp2","fixed_in":["1.39.2-3.26.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nghttp2","fixed_in":["1.43.0-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nghttp2","fixed_in":["1.59.0-1ubuntu0.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"nghttp2","fixed_in":["1.64.0-1.1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nghttp2","fixed_in":["1.68.0-2ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","fixed_in":["1.69.0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"nghttp2","fixed_in":["1.64.0-160000.4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.70.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"fluent-bit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.10-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.65.0-r0"},{"fixed":"1.69.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.52.0-r0"},{"fixed":"1.70.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.65.0-r0"},{"fixed":"1.69.0-r1"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.52.0-r0"},{"fixed":"1.70.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-6.el9_6.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-5.el9_2.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-5.el9_2.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-5.el9_2.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.52.0-1","1.52.0-1+deb12u1","1.52.0-1+deb12u2","1.52.0-1+deb12u3","1.53.0-1","1.54.0-1","1.55.1-1","1.56.0-1","1.57.0-1","1.58.0-1","1.59.0-1","1.60.0-1","1.61.0-1","1.62.1-1","1.62.1-2","1.63.0-1","1.64.0-1","1.64.0-1.1","1.68.0-1","1.68.0-2","1.68.1-1","1.69.0-1","1.70.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.64.0-1.1","1.64.0-1.1+deb13u1","1.68.0-1","1.68.0-2","1.68.1-1","1.69.0-1","1.70.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.70.0-1"}]}],"versions":["1.64.0-1.1","1.68.0-1","1.68.0-2","1.68.1-1","1.69.0-1"]},{"source":"osv","ecosystem":"Julia","package":"nghttp2_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.70.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68.1-2.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.61.0-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.41.0-8.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.46.0-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.0-4.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.58.0-4.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw32-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw64-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-3.1.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.21.0-0.1.1.hum1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw32-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"mingw64-libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.69.0-5.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"libnghttp2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"nghttp2-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.68.0-3.el10_2.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.43.0-6.el9_8.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.33.0-6.el8_10.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-1+deb12u3.aikido.2"},{"fixed":"1.52.0-1+deb12u3.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-1+deb12u3.aikido.2"},{"fixed":"1.52.0-1+deb12u3.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-1.1+deb13u1.aikido.2"},{"fixed":"1.64.0-1.1+deb13u1.aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-1.1+deb13u1.aikido.2"},{"fixed":"1.64.0-1.1+deb13u1.aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-160000.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.52.0-slfo.1.1_3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-150200.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-150200.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-150200.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.40.0-150600.25.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.39.2-3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-150700.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.7-1","1.3.4-2","1.4.0-1","1.4.0-2","1.5.0-2","1.6.0-1","1.7.0-1","1.7.1-1","1.7.1-1ubuntu0.1~esm1","1.7.1-1ubuntu0.1~esm2","1.7.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.25.0-1","1.27.0-1","1.28.0-1","1.29.0-1","1.29.0-1build1","1.30.0-1","1.30.0-1ubuntu1","1.30.0-1ubuntu1+esm1","1.30.0-1ubuntu1+esm2","1.30.0-1ubuntu1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39.2-1","1.40.0-1","1.40.0-1build1","1.40.0-1ubuntu0.1","1.40.0-1ubuntu0.2","1.40.0-1ubuntu0.3","1.40.0-1ubuntu0.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1ubuntu0.4"}]}],"versions":["1.43.0-1","1.43.0-1build1","1.43.0-1build2","1.43.0-1build3","1.43.0-1ubuntu0.1","1.43.0-1ubuntu0.2","1.43.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-1ubuntu0.4"}]}],"versions":["1.55.1-1","1.57.0-1","1.58.0-1","1.59.0-1","1.59.0-1build1","1.59.0-1build2","1.59.0-1build4","1.59.0-1ubuntu0.1","1.59.0-1ubuntu0.2","1.59.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-1.1ubuntu1.2"}]}],"versions":["1.64.0-1ubuntu1","1.64.0-1.1","1.64.0-1.1build1","1.64.0-1.1ubuntu1","1.64.0-1.1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68.0-2ubuntu0.2"}]}],"versions":["1.64.0-1.1ubuntu1","1.64.0-1.1ubuntu2","1.68.0-1","1.68.0-2","1.68.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.43.0-1ubuntu0.4"}]}],"versions":["1.43.0-1","1.43.0-1build1","1.43.0-1build2","1.43.0-1build3","1.43.0-1ubuntu0.1","1.43.0-1ubuntu0.2","1.43.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.59.0-1ubuntu0.4"}]}],"versions":["1.55.1-1","1.57.0-1","1.58.0-1","1.59.0-1","1.59.0-1build1","1.59.0-1build2","1.59.0-1build4","1.59.0-1ubuntu0.1","1.59.0-1ubuntu0.2","1.59.0-1ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-1.1ubuntu1.2"}]}],"versions":["1.64.0-1ubuntu1","1.64.0-1.1","1.64.0-1.1build1","1.64.0-1.1ubuntu1","1.64.0-1.1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.68.0-2ubuntu0.2"}]}],"versions":["1.64.0-1.1ubuntu1","1.64.0-1.1ubuntu2","1.68.0-1","1.68.0-2","1.68.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.69.0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nghttp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.64.0-160000.4.1"}]}]}],"products":[{"vendor":"nghttp2","product":"nghttp2"}],"references":[{"url":"https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc","tags":["exploit","third-party-advisory","Broken Link","evidence","web","article","report"]},{"url":"https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e","tags":["patch","Patch","fix","web","article"]},{"url":"https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length","tags":["third-party-advisory","Patch","Third Party Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-58055","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-xrr7-82jr-v58x","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-58055","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54650","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-58055","tags":["report"]},{"url":"https://bugzilla.redhat.com/2493954","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-54650.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54662","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-54662.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:55804","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-55804.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-58055","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1787308423.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1787754280.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58055.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-58055","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0309.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35814","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8495-1","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2977","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2978","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2979","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2980","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:35454","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_35454.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493954","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-58055","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41240","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9545","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41240.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496756","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9545","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9545","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-9545.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-9545.json","tags":["article"]},{"url":"https://hackerone.com/reports/3752888","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10536","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10536","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-10536.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-10536.json","tags":["article"]},{"url":"https://hackerone.com/reports/3751697","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:52414","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52414.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54650.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54662.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_55804.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54650","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:54662","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:55804","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622594-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269489","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-58055","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622630-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622707-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622893-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262883-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263153-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263154-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264029-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-58055","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-58055","title":"nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T01:32:57.163Z","modified":"2026-06-29T13:51:59.891Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-39975","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T01:32:57Z","modified":"2026-06-29T13:51:59Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:22.87152Z"}],"ghsa":[{"id":"GHSA-xrr7-82jr-v58x","title":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T03:33:40Z","modified":"2026-06-28T03:33:44Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:09:02.633671Z"}],"nvd":[{"id":"CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T02:16:32.677Z","modified":"2026-10-25T17:10:00.197Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:26.508751Z"}],"osv":[{"id":"ALPINE-CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T02:16:32.677Z","modified":"2026-10-01T13:30:02.960852065Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:27:50.764331Z"},{"id":"BELL-CVE-2026-58055","status":"published","published":"2026-07-01T06:04:46.5944Z","modified":"2026-08-11T07:15:04.119847079Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-58055","title":"nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T01:32:57.163Z","modified":"2026-10-28T10:57:57.833776242Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T02:16:32.677Z","modified":"2026-10-26T11:47:27.438279572Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"JLSEC-2026-1157","title":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-08-03T19:27:41.338Z","modified":"2026-08-03T19:35:53.455166902Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"OESA-2026-2977","title":"nghttp2 security update","description":"The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.\r\n\r\nSecurity Fix(es):\n\nnghttp2\u0026apos;s nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker\u0026apos;s favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:16.951907549Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2978","title":"nghttp2 security update","description":"The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.\r\n\r\nSecurity Fix(es):\n\nnghttp2\u0026apos;s nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker\u0026apos;s favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:17.000641448Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2979","title":"nghttp2 security update","description":"The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.\r\n\r\nSecurity Fix(es):\n\nnghttp2\u0026apos;s nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker\u0026apos;s favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:17.26003764Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-2980","title":"nghttp2 security update","description":"The framing layer of HTTP/2 is implemented as a form of reusable C library. On top of that, we have implemented HTTP/2 client, server and proxy. We have also developed load test and benchmarking tool for HTTP/2.\r\n\r\nSecurity Fix(es):\n\nnghttp2\u0026apos;s nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker\u0026apos;s favor enables HTTP request/response smuggling and cross-client response-queue poisoning.(CVE-2026-58055)","status":"published","published":"2026-07-09T11:11:52Z","modified":"2026-08-18T01:21:17.300326746Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"RHSA-2026:35454","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-23T10:11:15Z","modified":"2026-10-15T10:17:32Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:41240","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-07-23T10:13:28Z","modified":"2026-10-20T10:08:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:52414","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-08-10T10:13:36Z","modified":"2026-10-15T10:20:59Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54650","title":"Red Hat Security Advisory: nghttp2 security update","status":"published","published":"2026-08-14T10:17:01Z","modified":"2026-10-15T10:21:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:54662","title":"Red Hat Security Advisory: nghttp2 security update","status":"published","published":"2026-08-14T10:17:04Z","modified":"2026-10-15T10:21:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RHSA-2026:55804","title":"Red Hat Security Advisory: nghttp2 security update","status":"published","published":"2026-08-18T10:21:13Z","modified":"2026-10-15T10:21:33Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.457353Z"},{"id":"RLSA-2026:54650","title":"Moderate: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-14T12:06:50.87278Z","modified":"2026-08-14T12:30:04.753209741Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:54662","title":"Moderate: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-14T12:04:07.449605Z","modified":"2026-08-14T12:30:04.772911203Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"RLSA-2026:55804","title":"Moderate: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.\n\nSecurity Fix(es):\n\n* nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-08-18T06:00:58.283966Z","modified":"2026-08-18T06:30:06.084632774Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.111232Z"},{"id":"UBUNTU-CVE-2026-58055","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T02:16:00Z","modified":"2026-07-02T18:03:26.175084971Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"ALSA-2026:54650","title":"Moderate: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.  \n\nSecurity Fix(es):  \n\n  * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-13T00:00:00Z","modified":"2026-10-29T11:30:34.731161275Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:54662","title":"Moderate: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.  \n\nSecurity Fix(es):  \n\n  * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-13T00:00:00Z","modified":"2026-10-29T11:32:24.971825063Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"ALSA-2026:55804","title":"Moderate: nghttp2 security update","description":"libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.  \n\nSecurity Fix(es):  \n\n  * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-08-17T00:00:00Z","modified":"2026-10-29T11:02:28.860890752Z","updated_at":"2026-11-02T15:27:54.753319Z"},{"id":"AZL-91451","title":"CVE-2026-58055 affecting package fluent-bit for versions less than 3.1.10-6","description":"nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.","status":"published","published":"2026-06-28T02:16:32Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"CLSA-2026-1787308423","title":"nghttp2: Fix of CVE-2026-58055","description":"- CVE-2026-58055: reject Upgrade/CONNECT requests carrying a body and stop\n  forwarding them onto reusable keep-alive backend connections","status":"published","published":"2026-08-21T10:33:53Z","modified":"2026-10-26T09:31:28.91125162Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1787754280","title":"nghttp2: Fix of CVE-2026-58055","description":"- CVE-2026-58055: fix HTTP request/response smuggling via HTTP/1.1 Upgrade request with Content-Length","status":"published","published":"2026-08-26T14:24:59Z","modified":"2026-10-26T09:30:37.852700472Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"MGASA-2026-0309","title":"Updated nghttp2 packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nHTTP Request/Response Smuggling via Upgrade Request with Content-Length.\n(CVE-2026-58055)\n","status":"published","published":"2026-07-30T17:03:15Z","modified":"2026-07-30T17:15:06.622246324Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11156-1","title":"libnghttp2-14-1.69.0-2.1 on GA media","description":"These are all security issues fixed in the libnghttp2-14-1.69.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-30T00:00:00Z","modified":"2026-07-01T09:45:08.745697016Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21302-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP request/response smuggling via upgrade request with `Content-Length` (bsc#1269489).\n","status":"published","published":"2026-07-10T13:13:53Z","modified":"2026-07-13T18:24:58.613821782Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-58055","title":"CVE-2026-58055 in nghttp2 - Patched by Root","description":"Root has patched CVE-2026-58055 in the nghttp2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T12:13:53Z","modified":"2026-08-26T01:12:43.039513017Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-58055","title":"CVE-2026-58055 in nghttp2 - Patched by Root","description":"Root has patched CVE-2026-58055 in the nghttp2 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T16:10:32Z","modified":"2026-08-24T18:45:11.886326192Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:22594-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP request/response smuggling via upgrade request with `Content-Length` (bsc#1269489).\n","status":"published","published":"2026-07-10T13:13:11Z","modified":"2026-07-16T18:24:37.91361253Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22630-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP request/response smuggling via upgrade request with `Content-Length` (bsc#1269489).\n","status":"published","published":"2026-07-10T13:13:11Z","modified":"2026-07-17T18:24:03.795766195Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22707-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP request/response smuggling via upgrade request with `Content-Length` (bsc#1269489).\n","status":"published","published":"2026-07-10T08:05:09Z","modified":"2026-07-23T18:24:15.395799419Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22893-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP request/response smuggling via upgrade request with `Content-Length` (bsc#1269489).\n","status":"published","published":"2026-07-22T09:00:00Z","modified":"2026-07-28T18:24:18.535660768Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2883-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning\n  (bsc#1269489).\n","status":"published","published":"2026-07-13T09:54:48Z","modified":"2026-07-14T09:15:05.030996756Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3153-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning\n  (bsc#1269489).\n","status":"published","published":"2026-07-21T12:54:28Z","modified":"2026-07-22T09:30:08.798971163Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3154-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue\n\n- CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning\n  (bsc#1269489).\n","status":"published","published":"2026-07-21T12:55:40Z","modified":"2026-07-22T09:30:07.499664736Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:4029-1","title":"Security update for nghttp2","description":"This update for nghttp2 fixes the following issue:\n\n- CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning\n  (bsc#1269489).\n","status":"published","published":"2026-09-07T07:45:36Z","modified":"2026-09-13T18:23:16.95349637Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8495-1","title":"nghttp2 vulnerability","description":"It was discovered that the nghttp2 nghttpx proxy incorrectly handled\nHTTP/1.1 Upgrade requests that included a Content-Length header and body.\nA remote attacker could possibly use this issue to perform HTTP request and\nresponse smuggling attacks against backend services.","status":"published","published":"2026-07-02T13:57:53Z","modified":"2026-07-02T18:19:26.231523093Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}