CVE-2026-58055

Name
CVE-2026-58055
Description
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
disclosure@vulncheck.com https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc
disclosure@vulncheck.com https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e
disclosure@vulncheck.com https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:nghttp2:nghttp2:*:*:*:*:*:*:*:* nghttp2 >= None <= 1.69.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
nghttp2 edge-main 1.69.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.68.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.68.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.67.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.66.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.65.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.64.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.57.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 edge-main 1.41.0-r0 None possibly vulnerable
nghttp2 edge-main 1.39.2-r0 None possibly vulnerable
nghttp2 3.24-main 1.69.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.23-main 1.69.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.23-main 1.68.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.22-main 1.69.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.22-main 1.65.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.22-main 1.57.0-r0 None possibly vulnerable
nghttp2 3.22-main 1.41.0-r0 None possibly vulnerable
nghttp2 3.22-main 1.39.2-r0 None possibly vulnerable
nghttp2 3.21-main 1.69.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.21-main 1.64.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.21-main 1.57.0-r0 None possibly vulnerable
nghttp2 3.21-main 1.41.0-r0 None possibly vulnerable
nghttp2 3.21-main 1.39.2-r0 None possibly vulnerable
nghttp2 3.20-main 1.62.1-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.20-main 1.57.0-r0 None possibly vulnerable
nghttp2 3.20-main 1.41.0-r0 None possibly vulnerable
nghttp2 3.20-main 1.39.2-r0 None possibly vulnerable
nghttp2 3.19-main 1.58.0-r0 Francesco Colista <fcolista@alpinelinux.org> possibly vulnerable
nghttp2 3.19-main 1.57.0-r0 None possibly vulnerable
nghttp2 3.19-main 1.41.0-r0 None possibly vulnerable
nghttp2 3.19-main 1.39.2-r0 None possibly vulnerable