# CVE-2026-58055: nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

CVE-2026-58055 is fixed in 14 products on 1 platform, first by libnghttp2-14 1.68.0-2ubuntu0.2, released June 27, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-58055
- Priority: Routine
- CVSS: 5.4 (Moderate)
- EPSS: 0.0025
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 27, 2026
- Weakness: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58055

## Description

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.  Security Fix(es):  * nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libnghttp2 Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | libnghttp2 RHEL 8 | 0:1.33.0-6.el8_10.3 | [RHSA-2026:55804](https://patchblox.com/security/data/fix/linux/rhsa-2026-55804.md) | Aug 19, 2026 |
| Linux | libnghttp2 RHEL 9 | 0:1.43.0-6.el9_8.2 | [RHSA-2026:54662](https://patchblox.com/security/data/fix/linux/rhsa-2026-54662.md) | Aug 14, 2026 |
| Linux | libnghttp2 almalinux 10 | 1.68.0-3.el10_2.2 | [ALSA-2026:54650](https://patchblox.com/security/data/fix/linux/alsa-2026-54650.md) | Aug 13, 2026 |
| Linux | libnghttp2 almalinux 8 | 1.33.0-6.el8_10.3 | [ALSA-2026:55804](https://patchblox.com/security/data/fix/linux/alsa-2026-55804.md) | Aug 17, 2026 |
| Linux | libnghttp2 almalinux 9 | 1.43.0-6.el9_8.2 | [ALSA-2026:54662](https://patchblox.com/security/data/fix/linux/alsa-2026-54662.md) | Aug 13, 2026 |
| Linux | libnghttp2 ol 10 | 0:1.68.0-3.el10_2.2 | [ELSA-2026-54650](https://patchblox.com/security/data/fix/linux/elsa-2026-54650.md) | Aug 13, 2026 |
| Linux | libnghttp2 ol 8 | 0:1.33.0-6.el8_10.3 | [ELSA-2026-55804](https://patchblox.com/security/data/fix/linux/elsa-2026-55804.md) | Aug 18, 2026 |
| Linux | libnghttp2 ol 9 | 0:1.43.0-6.el9_8.2 | [ELSA-2026-54662](https://patchblox.com/security/data/fix/linux/elsa-2026-54662.md) | Aug 13, 2026 |
| Linux | libnghttp2-14 Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | [libnghttp2-14 1.43.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libnghttp2-14-1.43.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | libnghttp2-14 Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | [libnghttp2-14 1.59.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libnghttp2-14-1.59.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | libnghttp2-14 Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | [libnghttp2-14 1.64.0-1.1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libnghttp2-14-1.64.0-1.1ubuntu1.2.md) | Jul 3, 2026 |
| Linux | libnghttp2-14 Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | [libnghttp2-14 1.68.0-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libnghttp2-14-1.68.0-2ubuntu0.2.md) | Jun 27, 2026 |
| Linux | libnghttp2-debuginfo Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | libnghttp2-devel Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | libnghttp2-devel RHEL 8 | 0:1.33.0-6.el8_10.3 | [RHSA-2026:55804](https://patchblox.com/security/data/fix/linux/rhsa-2026-55804.md) | Aug 19, 2026 |
| Linux | libnghttp2-devel RHEL 9 | 0:1.43.0-6.el9_8.2 | [RHSA-2026:54662](https://patchblox.com/security/data/fix/linux/rhsa-2026-54662.md) | Aug 14, 2026 |
| Linux | libnghttp2-devel almalinux 10 | 1.68.0-3.el10_2.2 | [ALSA-2026:54650](https://patchblox.com/security/data/fix/linux/alsa-2026-54650.md) | Aug 13, 2026 |
| Linux | libnghttp2-devel almalinux 8 | 1.33.0-6.el8_10.3 | [ALSA-2026:55804](https://patchblox.com/security/data/fix/linux/alsa-2026-55804.md) | Aug 17, 2026 |
| Linux | libnghttp2-devel almalinux 9 | 1.43.0-6.el9_8.2 | [ALSA-2026:54662](https://patchblox.com/security/data/fix/linux/alsa-2026-54662.md) | Aug 13, 2026 |
| Linux | libnghttp2-devel ol 10 | 0:1.68.0-3.el10_2.2 | [ELSA-2026-54650](https://patchblox.com/security/data/fix/linux/elsa-2026-54650.md) | Aug 13, 2026 |
| Linux | libnghttp2-devel ol 8 | 0:1.33.0-6.el8_10.3 | [ELSA-2026-55804](https://patchblox.com/security/data/fix/linux/elsa-2026-55804.md) | Aug 18, 2026 |
| Linux | libnghttp2-devel ol 9 | 0:1.43.0-6.el9_8.2 | [ELSA-2026-54662](https://patchblox.com/security/data/fix/linux/elsa-2026-54662.md) | Aug 13, 2026 |
| Linux | mingw32-libnghttp2 Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | mingw32-nghttp2-debuginfo Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | mingw64-libnghttp2 Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | mingw64-nghttp2-debuginfo Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | nghttp2 Debian 14 | 1.70.0-1 | [DEBIAN-CVE-2026-58055](https://patchblox.com/security/data/fix/linux/debian-cve-2026-58055.md) | Jun 28, 2026 |
| Linux | nghttp2 Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | nghttp2 RHEL 10 | 1.68.0-3.el10_2.2 | [RHSA-2026:54650](https://patchblox.com/security/data/fix/linux/rhsa-2026-54650.md) | Jun 28, 2026 |
| Linux | nghttp2 RHEL 8 | 0:1.33.0-6.el8_10.3 | [RHSA-2026:55804](https://patchblox.com/security/data/fix/linux/rhsa-2026-55804.md) | Aug 19, 2026 |
| Linux | nghttp2 RHEL 9 | 0:1.43.0-6.el9_8.2 | [RHSA-2026:54662](https://patchblox.com/security/data/fix/linux/rhsa-2026-54662.md) | Aug 14, 2026 |
| Linux | nghttp2 Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | [nghttp2 1.43.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nghttp2-1.43.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2 Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | [nghttp2 1.59.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-nghttp2-1.59.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2 Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | [nghttp2 1.64.0-1.1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-nghttp2-1.64.0-1.1ubuntu1.2.md) | Jul 3, 2026 |
| Linux | nghttp2 Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | [nghttp2 1.68.0-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-nghttp2-1.68.0-2ubuntu0.2.md) | Jun 27, 2026 |
| Linux | nghttp2 almalinux 10 | 1.68.0-3.el10_2.2 | [ALSA-2026:54650](https://patchblox.com/security/data/fix/linux/alsa-2026-54650.md) | Aug 13, 2026 |
| Linux | nghttp2 almalinux 8 | 1.33.0-6.el8_10.3 | [ALSA-2026:55804](https://patchblox.com/security/data/fix/linux/alsa-2026-55804.md) | Aug 17, 2026 |
| Linux | nghttp2 almalinux 9 | 1.43.0-6.el9_8.2 | [ALSA-2026:54662](https://patchblox.com/security/data/fix/linux/alsa-2026-54662.md) | Aug 13, 2026 |
| Linux | nghttp2 ol 10 | 0:1.68.0-3.el10_2.2 | [ELSA-2026-54650](https://patchblox.com/security/data/fix/linux/elsa-2026-54650.md) | Aug 13, 2026 |
| Linux | nghttp2 ol 8 | 0:1.33.0-6.el8_10.3 | [ELSA-2026-55804](https://patchblox.com/security/data/fix/linux/elsa-2026-55804.md) | Aug 18, 2026 |
| Linux | nghttp2 ol 9 | 0:1.43.0-6.el9_8.2 | [ELSA-2026-54662](https://patchblox.com/security/data/fix/linux/elsa-2026-54662.md) | Aug 13, 2026 |
| Linux | nghttp2 opensuse-leap 16.0 | 1.64.0-160000.4.1 | [OPENSUSE-SU-2026:21302-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21302-1.md) | Jul 10, 2026 |
| Linux | nghttp2 rocky 10 | 0:1.68.0-3.el10_2.2 | [RLSA-2026:54650](https://patchblox.com/security/data/fix/linux/rlsa-2026-54650.md) | Aug 14, 2026 |
| Linux | nghttp2 rocky 8 | 0:1.33.0-6.el8_10.3 | [RLSA-2026:55804](https://patchblox.com/security/data/fix/linux/rlsa-2026-55804.md) | Aug 18, 2026 |
| Linux | nghttp2 rocky 9 | 0:1.43.0-6.el9_8.2 | [RLSA-2026:54662](https://patchblox.com/security/data/fix/linux/rlsa-2026-54662.md) | Aug 14, 2026 |
| Linux | nghttp2 sles 15.7 | 1.64.0-150700.3.6.1 | [SUSE-SU-2026:4029-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4029-1.md) | Sep 7, 2026 |
| Linux | nghttp2 sles 16.0 | 1.64.0-160000.4.1 | [SUSE-SU-2026:22630-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22630-1.md) | Jul 10, 2026 |
| Linux | nghttp2-client Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | [nghttp2-client 1.43.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nghttp2-client-1.43.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2-client Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | [nghttp2-client 1.59.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-nghttp2-client-1.59.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2-client Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | [nghttp2-client 1.64.0-1.1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-nghttp2-client-1.64.0-1.1ubuntu1.2.md) | Jul 3, 2026 |
| Linux | nghttp2-client Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | [nghttp2-client 1.68.0-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-nghttp2-client-1.68.0-2ubuntu0.2.md) | Jun 27, 2026 |
| Linux | nghttp2-debuginfo Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | nghttp2-debugsource Fedora 43 | 1.66.0-3.fc43 | [FEDORA-2026-91DD0C29D6](https://patchblox.com/security/data/fix/linux/fedora-2026-91dd0c29d6.md) | Aug 7, 2026 |
| Linux | nghttp2-proxy Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | [nghttp2-proxy 1.43.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nghttp2-proxy-1.43.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2-proxy Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | [nghttp2-proxy 1.59.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-nghttp2-proxy-1.59.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2-proxy Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | [nghttp2-proxy 1.64.0-1.1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-nghttp2-proxy-1.64.0-1.1ubuntu1.2.md) | Jul 3, 2026 |
| Linux | nghttp2-proxy Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | [nghttp2-proxy 1.68.0-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-nghttp2-proxy-1.68.0-2ubuntu0.2.md) | Jun 27, 2026 |
| Linux | nghttp2-server Ubuntu 22.04.1 LTS (jammy) | 1.43.0-1ubuntu0.4 | [nghttp2-server 1.43.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-nghttp2-server-1.43.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2-server Ubuntu 24.04.5 LTS (noble) | 1.59.0-1ubuntu0.4 | [nghttp2-server 1.59.0-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-nghttp2-server-1.59.0-1ubuntu0.4.md) | Jul 3, 2026 |
| Linux | nghttp2-server Ubuntu 25.10 (questing) | 1.64.0-1.1ubuntu1.2 | [nghttp2-server 1.64.0-1.1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-questing-nghttp2-server-1.64.0-1.1ubuntu1.2.md) | Jul 3, 2026 |
| Linux | nghttp2-server Ubuntu 26.04.1 LTS (resolute) | 1.68.0-2ubuntu0.2 | [nghttp2-server 1.68.0-2ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-nghttp2-server-1.68.0-2ubuntu0.2.md) | Jun 27, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.