Back Linuxsecurity

Fedora 44 nghttp2 Important HTTP Smuggling CVE-2026

Linuxsecurity •LinuxSecurity Advisories • August 9, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

This package contains the HTTP/2 client, server and proxy programs.

fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

* Fri Aug 7 2026 Jan Macku - 1.68.0-5 - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

[ 1 ] Bug #2502788 - CVE-2026-58055 nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-084c991d17' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical HTTP Request Smuggling Vulnerability in Fedora 43 and 44 A critical vulnerability (CVE-2026-58055) affecting the nghttp2 package in Fedora 43 and 44 was disclosed, allowing HTTP request/response smuggling and response-queue poisoning via ambiguous HTTP/1.1 Upgrade requests. This vulnerability impacts systems running the HTTP/2 client, server, and proxy programs. The flaw was published on June 28, 2026, and updates to mitigate the risk were released on August 7, 2026. Users are advised to upgrade to the latest versions (1.66.0-3 for Fedora 43 and 1.68.0-5 for Fedora 44) to secure their systems. The vulnerability poses a significant risk of compromise and escalation of privileges if left unaddressed. The updates can be installed using the dnf package manager. Security professionals are urged to audit Linux privileges to limit potential damage. 5 sources 73

Extracted Entities

CVEs (1)

CVE-2026-58055

Platforms (1)

Linux