Moderate Security Update: libnghttp2 Vulnerability in AlmaLinux
Summary
ALSA-2026:54662: Moderate: nghttp2 security update. Affects libnghttp2 versions < 1.43.0-6.el9_8.2. Fixed in 1.43.0-6.el9_8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libnghttp2 is a C library that implements the Hypertext Transfer Protocol version 2 (HTTP/2). It is widely used for its efficient handling of HTTP/2 requests and responses, providing features such as multiplexing and header compression. However, it is vulnerable to specific security issues that can lead to serious implications if not addressed promptly.
Vulnerability Detail
The vulnerability identified as CVE-2026-58055 allows for HTTP Request/Response Smuggling and Response-Queue Poisoning through ambiguous HTTP/1.1 Upgrade requests. This can result in attackers manipulating the request/response flow, potentially leading to unauthorized access or data leakage. The issue arises from the way the library processes upgrade requests, making it susceptible to crafted inputs that exploit these ambiguities.
How To Fix
Minimum fixed version
1.43.0-6.el9_8.2
This is the first release that contains the fix.
sudo dnf update libnghttp2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict validation of HTTP requests and ensure that ambiguous upgrade requests are rejected. However, this is not a substitute for applying the necessary updates.
Conclusion
The vulnerability in libnghttp2, identified as CVE-2026-58055, poses a moderate security risk that can lead to serious implications if not addressed. Updating to the patched version is crucial for maintaining the security of applications utilizing this library.
See every vulnerability recorded for libnghttp2 →
FAQ
CVE-2026-58055 is a security vulnerability in the libnghttp2 library that allows for HTTP Request/Response Smuggling and Response-Queue Poisoning.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access, data leakage, and manipulation of HTTP request/response flows, posing significant security risks.
Yes, the patched version is 1.43.0-6.el9_8.2. It is recommended to update to this version to mitigate the vulnerability.
If immediate updates are not possible, implement strict validation of HTTP requests to mitigate the risk until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for libnghttp2.
