AlmaLinux 9.6 [TuxCare] Security Update: libnghttp2 / libnghttp2-devel / nghttp2 (ALMALINUX9.6:CLSA-2026:1787308423)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1787308423 advisory. - nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusab...

EulerOS 2.0 SP12 : nghttp2 (EulerOS-SA-2026-3286)

According to the versions of the nghttp2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content- Length header and body onto reusable...

Malicious code in dependencies-upgrade-request-celeste (npm)

Source: amazon-inspector 465f8a5b50c89ad9d8f18c8e6892238427b94313db41734688588131e2951400 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CLSA-2026-1787754280 nghttp2: Fix of CVE-2026-58055

CVE-2026-58055: fix HTTP request/response smuggling via HTTP/1.1 Upgrade request with Content-Length...

Oracle Linux 8 : nghttp2 (ELSA-2026-55804)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-55804 advisory. 1.33.0-6.3 - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

Moderate: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 HTTP/2 protocol in C. Security Fixes: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 For more details about the security issues,...

MGASA-2026-0309 Updated nghttp2 packages fix a security vulnerability

The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. CVE-2026-58055...

Updated nghttp2 packages fix a security vulnerability

The updated packages fix a security vulnerability: HTTP Request/Response Smuggling via Upgrade Request with Content-Length. CVE-2026-58055...

SUSE-SU-2026:3154-1 Security update for nghttp2

This update for nghttp2 fixes the following issue - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request smuggling and cross-client response-queue poisoning bsc1269489...

openSUSE 16 Security Update : nghttp2 (openSUSE-SU-2026:21302-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21302-1 advisory. This update for nghttp2 fixes the following issue - CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length bsc1269489...

OPENSUSE-SU-2026:21302-1 Security update for nghttp2

This update for nghttp2 fixes the following issue - CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length bsc1269489...

SUSE-SU-2026:22594-1 Security update for nghttp2

This update for nghttp2 fixes the following issue - CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length bsc1269489...

SUSE-SU-2026:22707-1 Security update for nghttp2

This update for nghttp2 fixes the following issue - CVE-2026-58055: HTTP request/response smuggling via upgrade request with Content-Length bsc1269489...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the handling of HTTP/1.1 Upgrade requests containing a Content-Length header and body on reusable keep-alive backend connections. An attacker can manipulate backend responses by crafting ambiguous HTTP messages...

CVE-2026-58055

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-58055

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-58055: Inconsistent Interpretation of HTTP Requests

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

CVE-2026-58055: Inconsistent Interpretation of HTTP Requests

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting...

AdGuard Home: HTTP/2 Cleartext (h2c) Upgrade Authentication Bypass

VULNERABILITY: HTTP/2 Cleartext h2c Upgrade Authentication Bypass ======================================================================== Severity: CRITICAL CVSS 3.1: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE: CWE-287 Improper Authentication Component: internal/home/web.go Affected:...

PT-2025-42759

Name of the Vulnerable Software and Affected Versions libwebsockets affected versions not specified Description A use-after-free issue exists in the WebSocket server implementation within the lws handshake server function of libwebsockets. This can lead to a denial of service if an attacker...