PT-2026-53087
CVE-2026-58055
·
Published
2026-05-22
·
Updated
2026-09-07
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
nghttp2 nghttpx versions prior to 1.69.0
Description
The nghttpx proxy forwards HTTP/1.1 Upgrade requests that contain a
Content-Length header and body onto reusable keep-alive backend connections. During this process, it re-adds the Upgrade and Connection headers while passing the Content-Length verbatim. If a backend resolves this ambiguous message in favor of an attacker, it can lead to HTTP request/response smuggling and cross-client response-queue poisoning. There have been reports of increased actor activities targeting this issue.Recommendations
Update nghttp2 nghttpx to version 1.69.0 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾