CVE-2026-58055

Name	CVE-2026-58055
Description	nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140917

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nghttp2 (PTS)	bullseye	1.43.0-1+deb11u1	vulnerable
	bullseye (security)	1.43.0-1+deb11u3	vulnerable
	bookworm	1.52.0-1+deb12u2	vulnerable
	bookworm (security)	1.52.0-1+deb12u3	vulnerable
	trixie	1.64.0-1.1	vulnerable
	trixie (security)	1.64.0-1.1+deb13u1	vulnerable
	forky, sid	1.69.0-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nghttp2	source	(unstable)	(unfixed)			1140917

Notes

https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc
https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e