CVE-2026-58055
EUVD-2026-3997528.06.2026, 02:16
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nghttp2 | nghttp2 | 𝑥 ≤ 1.69.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
openSUSE / SLES Releases
openSUSE Product | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| libnghttp2-14 |
| ||||||||
| libnghttp2-14-32bit |
| ||||||||
| libnghttp2-devel |
| ||||||||
| libnghttp2_asio-devel |
| ||||||||
| libnghttp2_asio1 |
|
Vulnerability Media Exposure
References