Skip to content

CVE-2026-58055 on CTRL-OS 26.05

Aliases: CVE-2026-58055

Packages: nghttp2

Status: Plausible

Advisory Information

nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.

Updates

2026-08-01 01:06 CEST

Metadata changes:

  • Status for package nghttp2: “Plausible”

2026-07-31 00:59 CEST

Metadata changes:

  • Status for package nghttp2: “New”