CVE-2026-58055
nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length
CVE-2026-58055 is fixed in 14 products on 1 platform, first by libnghttp2-14 1.68.0-2ubuntu0.2, released June 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
5.4
Moderate
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0025
16th percentile
libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libnghttp2 · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| libnghttp2 · RHEL 8 | 0:1.33.0-6.el8_10.3 | RHSA-2026:55804 | Aug 19, 2026 |
| libnghttp2 · RHEL 9 | 0:1.43.0-6.el9_8.2 | RHSA-2026:54662 | Aug 14, 2026 |
| libnghttp2 · almalinux 10 | 1.68.0-3.el10_2.2 | ALSA-2026:54650 | Aug 13, 2026 |
| libnghttp2 · almalinux 8 | 1.33.0-6.el8_10.3 | ALSA-2026:55804 | Aug 17, 2026 |
| libnghttp2 · almalinux 9 | 1.43.0-6.el9_8.2 | ALSA-2026:54662 | Aug 13, 2026 |
| libnghttp2 · ol 10 | 0:1.68.0-3.el10_2.2 | ELSA-2026-54650 | Aug 13, 2026 |
| libnghttp2 · ol 8 | 0:1.33.0-6.el8_10.3 | ELSA-2026-55804 | Aug 18, 2026 |
| libnghttp2 · ol 9 | 0:1.43.0-6.el9_8.2 | ELSA-2026-54662 | Aug 13, 2026 |
| libnghttp2-14 · Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | libnghttp2-14 1.43.0-1ubuntu0.4 | Jul 3, 2026 |
| libnghttp2-14 · Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | libnghttp2-14 1.59.0-1ubuntu0.4 | Jul 3, 2026 |
| libnghttp2-14 · Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | libnghttp2-14 1.64.0-1.1ubuntu1.2 | Jul 3, 2026 |
| libnghttp2-14 · Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | libnghttp2-14 1.68.0-2ubuntu0.2 | Jun 27, 2026 |
| libnghttp2-debuginfo · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| libnghttp2-devel · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| libnghttp2-devel · RHEL 8 | 0:1.33.0-6.el8_10.3 | RHSA-2026:55804 | Aug 19, 2026 |
| libnghttp2-devel · RHEL 9 | 0:1.43.0-6.el9_8.2 | RHSA-2026:54662 | Aug 14, 2026 |
| libnghttp2-devel · almalinux 10 | 1.68.0-3.el10_2.2 | ALSA-2026:54650 | Aug 13, 2026 |
| libnghttp2-devel · almalinux 8 | 1.33.0-6.el8_10.3 | ALSA-2026:55804 | Aug 17, 2026 |
| libnghttp2-devel · almalinux 9 | 1.43.0-6.el9_8.2 | ALSA-2026:54662 | Aug 13, 2026 |
| libnghttp2-devel · ol 10 | 0:1.68.0-3.el10_2.2 | ELSA-2026-54650 | Aug 13, 2026 |
| libnghttp2-devel · ol 8 | 0:1.33.0-6.el8_10.3 | ELSA-2026-55804 | Aug 18, 2026 |
| libnghttp2-devel · ol 9 | 0:1.43.0-6.el9_8.2 | ELSA-2026-54662 | Aug 13, 2026 |
| mingw32-libnghttp2 · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| mingw32-nghttp2-debuginfo · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| mingw64-libnghttp2 · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| mingw64-nghttp2-debuginfo · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| nghttp2 · Debian 14 | 1.70.0-1 | DEBIAN-CVE-2026-58055 | Jun 28, 2026 |
| nghttp2 · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| nghttp2 · RHEL 10 | 1.68.0-3.el10_2.2 | RHSA-2026:54650 | Jun 28, 2026 |
| nghttp2 · RHEL 8 | 0:1.33.0-6.el8_10.3 | RHSA-2026:55804 | Aug 19, 2026 |
| nghttp2 · RHEL 9 | 0:1.43.0-6.el9_8.2 | RHSA-2026:54662 | Aug 14, 2026 |
| nghttp2 · Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | nghttp2 1.43.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2 · Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | nghttp2 1.59.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2 · Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | nghttp2 1.64.0-1.1ubuntu1.2 | Jul 3, 2026 |
| nghttp2 · Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | nghttp2 1.68.0-2ubuntu0.2 | Jun 27, 2026 |
| nghttp2 · almalinux 10 | 1.68.0-3.el10_2.2 | ALSA-2026:54650 | Aug 13, 2026 |
| nghttp2 · almalinux 8 | 1.33.0-6.el8_10.3 | ALSA-2026:55804 | Aug 17, 2026 |
| nghttp2 · almalinux 9 | 1.43.0-6.el9_8.2 | ALSA-2026:54662 | Aug 13, 2026 |
| nghttp2 · ol 10 | 0:1.68.0-3.el10_2.2 | ELSA-2026-54650 | Aug 13, 2026 |
| nghttp2 · ol 8 | 0:1.33.0-6.el8_10.3 | ELSA-2026-55804 | Aug 18, 2026 |
| nghttp2 · ol 9 | 0:1.43.0-6.el9_8.2 | ELSA-2026-54662 | Aug 13, 2026 |
| nghttp2 · opensuse-leap 16.0 | 1.64.0-160000.4.1 | OPENSUSE-SU-2026:21302-1 | Jul 10, 2026 |
| nghttp2 · rocky 10 | 0:1.68.0-3.el10_2.2 | RLSA-2026:54650 | Aug 14, 2026 |
| nghttp2 · rocky 8 | 0:1.33.0-6.el8_10.3 | RLSA-2026:55804 | Aug 18, 2026 |
| nghttp2 · rocky 9 | 0:1.43.0-6.el9_8.2 | RLSA-2026:54662 | Aug 14, 2026 |
| nghttp2 · sles 15.7 | 1.64.0-150700.3.6.1 | SUSE-SU-2026:4029-1 | Sep 7, 2026 |
| nghttp2 · sles 16.0 | 1.64.0-160000.4.1 | SUSE-SU-2026:22630-1 | Jul 10, 2026 |
| nghttp2-client · Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | nghttp2-client 1.43.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2-client · Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | nghttp2-client 1.59.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2-client · Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | nghttp2-client 1.64.0-1.1ubuntu1.2 | Jul 3, 2026 |
| nghttp2-client · Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | nghttp2-client 1.68.0-2ubuntu0.2 | Jun 27, 2026 |
| nghttp2-debuginfo · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| nghttp2-debugsource · Fedora 43 | 1.66.0-3.fc43 | FEDORA-2026-91DD0C29D6 | Aug 7, 2026 |
| nghttp2-proxy · Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | nghttp2-proxy 1.43.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2-proxy · Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | nghttp2-proxy 1.59.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2-proxy · Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | nghttp2-proxy 1.64.0-1.1ubuntu1.2 | Jul 3, 2026 |
| nghttp2-proxy · Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | nghttp2-proxy 1.68.0-2ubuntu0.2 | Jun 27, 2026 |
| nghttp2-server · Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | nghttp2-server 1.43.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2-server · Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | nghttp2-server 1.59.0-1ubuntu0.4 | Jul 3, 2026 |
| nghttp2-server · Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | nghttp2-server 1.64.0-1.1ubuntu1.2 | Jul 3, 2026 |
| nghttp2-server · Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | nghttp2-server 1.68.0-2ubuntu0.2 | Jun 27, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.