5.4
Medium
CVE-2026-58055 nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header…
Description
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| nghttp2 1.69 | earliest → 1.69.0 | No fix stated |
References
- Proof of Concept github.com
- Fix commit (master) github.com
- VulnCheck Advisory: nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length www.vulncheck.com
Timeline
- Published
- Last modified
Other CVEs of nghttp2
The 5 CVEs of nghttp2 →
CVE-2026-27135
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
7.5
High
CVE-2024-28182
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C
5.3
Medium
CVE-2020-11080
In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service
3.7
Low
CVE-2016-1544
nghttp2 before 1.7.1 allows remote attackers to cause a denial of service (memory exhaustion)
Not rated