Red Hat Security Advisory

RHSA-2026:55804

nghttp2 security update

Released 2026-08-17 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) libnghttp2-1.33.0-6.el8_10.3, nghttp2-1.33.0-6.el8_10.3
Red Hat Enterprise Linux CRB (v. 8) libnghttp2-devel-1.33.0-6.el8_10.3, nghttp2-1.33.0-6.el8_10.3

Fixes 1 record

TI-2026-41809 CVE-2026-58055 · GHSA-xrr7-82jr-v58x

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

LOW 28

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers wh…

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00253 Published 2026-06-28 Partial fix CWE-444