p PatchFirst

CVE-2026-58055

CVE-2026-58055 · nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

This page contains facts from public vulnerability sources. Check the original advisory before updating.

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • nghttp2

    Versions
    • ≥ 0, ≤ 1.69.0: Affected (semver)

    No fix published

  • nghttp2 Debian:12

    Versions
    • 1.52.0-1
    • 1.52.0-1+deb12u1
    • 1.52.0-1+deb12u2
    • 1.52.0-1+deb12u3
    • 1.53.0-1
    • 1.54.0-1
    • 1.55.1-1
    • 1.56.0-1
    • 1.57.0-1
    • 1.58.0-1
    • 1.59.0-1
    • 1.60.0-1
    • 1.61.0-1
    • 1.62.1-1
    • 1.62.1-2
    • 1.63.0-1
    • 1.64.0-1
    • 1.64.0-1.1
    • 1.68.0-1
    • 1.68.0-2
    • 1.68.1-1
    • 1.69.0-1
    • 1.70.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nghttp2 Debian:13

    Versions
    • 1.64.0-1.1
    • 1.64.0-1.1+deb13u1
    • 1.68.0-1
    • 1.68.0-2
    • 1.68.1-1
    • 1.69.0-1
    • 1.70.0-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nghttp2 Debian:14

    Versions
    • 1.64.0-1.1
    • 1.68.0-1
    • 1.68.0-2
    • 1.68.1-1
    • 1.69.0-1
    Affected ranges
    • ECOSYSTEM: < 1.70.0-1

    Update to 1.70.0-1

  • nghttp2 Ubuntu:Pro:16.04:LTS

    Versions
    • 0.6.7-1
    • 1.3.4-2
    • 1.4.0-1
    • 1.4.0-2
    • 1.5.0-2
    • 1.6.0-1
    • 1.7.0-1
    • 1.7.1-1
    • 1.7.1-1ubuntu0.1~esm1
    • 1.7.1-1ubuntu0.1~esm2
    • 1.7.1-1ubuntu0.1~esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nghttp2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.25.0-1
    • 1.27.0-1
    • 1.28.0-1
    • 1.29.0-1
    • 1.29.0-1build1
    • 1.30.0-1
    • 1.30.0-1ubuntu1
    • 1.30.0-1ubuntu1+esm1
    • 1.30.0-1ubuntu1+esm2
    • 1.30.0-1ubuntu1+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nghttp2 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.39.2-1
    • 1.40.0-1
    • 1.40.0-1build1
    • 1.40.0-1ubuntu0.1
    • 1.40.0-1ubuntu0.2
    • 1.40.0-1ubuntu0.3
    • 1.40.0-1ubuntu0.3+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • nghttp2 Ubuntu:22.04:LTS

    Versions
    • 1.43.0-1
    • 1.43.0-1build1
    • 1.43.0-1build2
    • 1.43.0-1build3
    • 1.43.0-1ubuntu0.1
    • 1.43.0-1ubuntu0.2
    • 1.43.0-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 1.43.0-1ubuntu0.4

    Update to 1.43.0-1ubuntu0.4

  • nghttp2 Ubuntu:24.04:LTS

    Versions
    • 1.55.1-1
    • 1.57.0-1
    • 1.58.0-1
    • 1.59.0-1
    • 1.59.0-1build1
    • 1.59.0-1build2
    • 1.59.0-1build4
    • 1.59.0-1ubuntu0.1
    • 1.59.0-1ubuntu0.2
    • 1.59.0-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 1.59.0-1ubuntu0.4

    Update to 1.59.0-1ubuntu0.4

  • nghttp2 Ubuntu:25.10

    Versions
    • 1.64.0-1ubuntu1
    • 1.64.0-1.1
    • 1.64.0-1.1build1
    • 1.64.0-1.1ubuntu1
    • 1.64.0-1.1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 1.64.0-1.1ubuntu1.2

    Update to 1.64.0-1.1ubuntu1.2

  • nghttp2 Ubuntu:26.04:LTS

    Versions
    • 1.64.0-1.1ubuntu1
    • 1.64.0-1.1ubuntu2
    • 1.68.0-1
    • 1.68.0-2
    • 1.68.0-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 1.68.0-2ubuntu0.2

    Update to 1.68.0-2ubuntu0.2

Original sources

Check your server →