Critical HTTP Request Smuggling Vulnerability in Fedora 43 and 44

Linuxsecurity

Critical HTTP Request Smuggling Vulnerability in Fedora 43 and 44

First seen 11 Aug 2026, 03:47 UTC • •72.8

Article Content

1 / 6

Browse articles

ThreatCluster •August 12, 2026 at 03:22 UTC

•CVE-2026-58055 allows HTTP request/response smuggling in nghttp2 package.
•Affected systems include Fedora 43 and 44 running the HTTP/2 client and server.
•Users must upgrade to patched versions released on August 7, 2026, to mitigate risks.

A critical vulnerability (CVE-2026-58055) affecting the nghttp2 package in Fedora 43 and 44 was disclosed, allowing HTTP request/response smuggling and response-queue poisoning via ambiguous HTTP/1.1 Upgrade requests. This vulnerability impacts systems running the HTTP/2 client, server, and proxy programs. The flaw was published on June 28, 2026, and updates to mitigate the risk were released on August 7, 2026. Users are advised to upgrade to the latest versions (1.66.0-3 for Fedora 43 and 1.68.0-5 for Fedora 44) to secure their systems. The vulnerability poses a significant risk of compromise and escalation of privileges if left unaddressed. The updates can be installed using the dnf package manager. Security professionals are urged to audit Linux privileges to limit potential damage.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 61d ago How this analysis works

Timeline

2026-06-28

CVE-2026-58055 published

A critical vulnerability in nghttp2 was disclosed, allowing HTTP request/response smuggling.

2026-08-07

Patch released for Fedora 43 and 44

Updates were released to fix CVE-2026-58055, addressing the HTTP smuggling vulnerability.

2026-08-11

Critical vulnerability reported in Fedora advisories

Linuxsecurity published advisories highlighting the critical nature of CVE-2026-58055 and the need for immediate updates.

More articles in this cluster (5)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Organization (1)

Fedora

Vulnerability (3)

CVE-2026-58055
HTTP Request/Response Smuggling
Response-Queue Poisoning

Affected Platform (1)

Linux

Relationships

CVE-2026-58055 targets Linux
HTTP Request/Response Smuggling targets Linux
Response-Queue Poisoning targets Linux
CVE-2026-58055 related to Fedora

Following this threat?

Track Fedora and CVE-2026-58055 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…