Moderate Security Update for libnghttp2: HTTP Request/Response Smuggling Vulnerability
Summary
ALSA-2026:54650: Moderate: nghttp2 security update. Affects libnghttp2 versions < 1.68.0-3.el10_2.2. Fixed in 1.68.0-3.el10_2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libnghttp2 is a C library that implements the Hypertext Transfer Protocol version 2 (HTTP/2). It is widely used for efficient communication over the web, enabling faster data transfer and improved performance. However, it has been found to be vulnerable to specific security issues, particularly related to HTTP request/response smuggling and response-queue poisoning, which can compromise the integrity of web communications.
Vulnerability Detail
The vulnerability identified as CVE-2026-58055 allows for HTTP Request/Response Smuggling and Response-Queue Poisoning through ambiguous HTTP/1.1 Upgrade requests. This can lead to unauthorized access to sensitive information, manipulation of web traffic, and potential denial of service. The issue arises from the way the library handles HTTP upgrade requests, which can be exploited by attackers to inject malicious requests into the communication stream.
How To Fix
Minimum fixed version
1.68.0-3.el10_2.2
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can implement strict validation of HTTP requests and responses to mitigate the risk of exploitation until the packages are updated. This includes ensuring that all upgrade requests are properly formatted and do not contain ambiguous instructions.
Conclusion
The discovery of CVE-2026-58055 in the libnghttp2 library highlights the importance of maintaining up-to-date software to protect against potential security threats. Users are encouraged to promptly update their packages to the latest version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for libnghttp2 →
FAQ
CVE-2026-58055 is a vulnerability in the libnghttp2 library that allows for HTTP Request/Response Smuggling and Response-Queue Poisoning.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive information, manipulation of web traffic, and denial of service.
You can update the affected packages using the command: 'sudo dnf update libnghttp2 libnghttp2-devel nghttp2' to ensure you have the patched version.
Yes, implementing strict validation of HTTP requests and responses can serve as a temporary workaround until the packages are updated.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
