Red Hat Product Errata RHSA-2026:55804 - Security Advisory
Issued:
2026-08-17
Updated:
2026-08-17

RHSA-2026:55804 - Security Advisory

Synopsis

Moderate: nghttp2 security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for nghttp2 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C.

Security Fix(es):

  • nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for x86_64 8 x86_64
  • Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le
  • Red Hat CodeReady Linux Builder for ARM 64 8 aarch64
  • Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64
  • Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le
  • Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x

Fixes

  • BZ - 2493954 - CVE-2026-58055 nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

Red Hat Enterprise Linux for x86_64 8

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
x86_64
libnghttp2-1.33.0-6.el8_10.3.i686.rpm SHA-256: bf4d77d240fea68b4ed70496698ca567dcd48236695424329fd238357ee5a40c
libnghttp2-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 84133385c26f1ccb4da87df50b0a4dd19209dd440ea694eec4a3be55a1ade93a
libnghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: c495236a611659b49f2cb7ce6bcb87091f0d2fc3066bf6ccbddbda6bb41408eb
libnghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 598f65df61b3565dd93640a59d94201a30ccc722031a35d8cf71b1bedc0780e8
nghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: 10e485e3c7d2d6806782ca8773cecabda2fafb5db8a828346b4dbbb76b776f32
nghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: a566a7daacab48241709423d9a5139a66dfba0f5ad5176f9ed0a6e1253b1abbb
nghttp2-debugsource-1.33.0-6.el8_10.3.i686.rpm SHA-256: e4eb8eedd3bc9202b63fd028b8dd2e9493fa6a57080ceba00624aef61e7998f4
nghttp2-debugsource-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: db2ab1425b9e98cf6a6feadced86bf0ede2fd7df9f996ed22526dcc271cad7b0

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
s390x
libnghttp2-1.33.0-6.el8_10.3.s390x.rpm SHA-256: d0e5288ff8e1471dd63541e0ed04b6c18cc256a8c8e6af20a5106cc887130a62
libnghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 9acadef049eb47e65bad7d9322f8e0121f2fc10ba51d15c667ed33ff09d6072f
nghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 7c203d3f3e6c4ac72092608a6100940ee6bb781c1aa4b46343072788560e8bd0
nghttp2-debugsource-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 51cbbfd6a8b2dd29b77096f4cea183d91739d6440fae46e1c89de24a5cf33237

Red Hat Enterprise Linux for Power, little endian 8

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
ppc64le
libnghttp2-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: 50405901574c4956bc014b2300256c859e73954a794d8fbcab24f9b86bba9858
libnghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: cac3095bc1a29ab64d64e1962737f301144144d7f7100cb9416c435e33496034
nghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: ebba5c372a77e95a73e902f5c0fc275f6deb69bf2d5ec37d24d4e2f222c61801
nghttp2-debugsource-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: b567fe1756a186f9f4e5eeca9a63865d0639100a30521b75a3ddea114a829498

Red Hat Enterprise Linux for ARM 64 8

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
aarch64
libnghttp2-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 6f9e77e080174b36abadad04c2ea0149f3215448467ae97b9fe9f618b5eb96a0
libnghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 40002a82c0b73da91fbb6e9fa36bec83a17f95a36151bab3ce34de16de7b1459
nghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: d9f4f33e83ad67e7f3eb24175210c733aa20720f89e2fadc4f5bca977350fad0
nghttp2-debugsource-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 930162c2c58064d8ff25f7107695518ebe8fecd786ad2a4a894d52896fbabb78

Red Hat CodeReady Linux Builder for x86_64 8

SRPM
x86_64
libnghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: c495236a611659b49f2cb7ce6bcb87091f0d2fc3066bf6ccbddbda6bb41408eb
libnghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 598f65df61b3565dd93640a59d94201a30ccc722031a35d8cf71b1bedc0780e8
libnghttp2-devel-1.33.0-6.el8_10.3.i686.rpm SHA-256: a3c86a22b9dca784bd15685044f72e6519f2900f0b4b2d1c8cf9953d65292884
libnghttp2-devel-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: b73d1117b7f0af2f5ec70c052ef9689f762802a2eef0195021bc52930f55df19
nghttp2-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 799792772215302a7fc0420eca473ce0ddde02db6a327c78014ad474006f7208
nghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: 10e485e3c7d2d6806782ca8773cecabda2fafb5db8a828346b4dbbb76b776f32
nghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: a566a7daacab48241709423d9a5139a66dfba0f5ad5176f9ed0a6e1253b1abbb
nghttp2-debugsource-1.33.0-6.el8_10.3.i686.rpm SHA-256: e4eb8eedd3bc9202b63fd028b8dd2e9493fa6a57080ceba00624aef61e7998f4
nghttp2-debugsource-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: db2ab1425b9e98cf6a6feadced86bf0ede2fd7df9f996ed22526dcc271cad7b0

Red Hat CodeReady Linux Builder for Power, little endian 8

SRPM
ppc64le
libnghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: cac3095bc1a29ab64d64e1962737f301144144d7f7100cb9416c435e33496034
libnghttp2-devel-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: 101b137e24539846d6981e27724406d86aacaaf98aa28236da488747ba8654ea
nghttp2-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: aa108a685b90d7529df1ae20c918f28706da3e54d6a3134c8f232ef8804ca7d8
nghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: ebba5c372a77e95a73e902f5c0fc275f6deb69bf2d5ec37d24d4e2f222c61801
nghttp2-debugsource-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: b567fe1756a186f9f4e5eeca9a63865d0639100a30521b75a3ddea114a829498

Red Hat CodeReady Linux Builder for ARM 64 8

SRPM
aarch64
libnghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 40002a82c0b73da91fbb6e9fa36bec83a17f95a36151bab3ce34de16de7b1459
libnghttp2-devel-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: af5a8af706f84018561755b7e63d5596ed50eea044c6ae23a7e5f24cfaf9fd22
nghttp2-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 0741afa37925b345b3b6ccae776667ff5be2185b54a35eaf81205bc58dda9ffd
nghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: d9f4f33e83ad67e7f3eb24175210c733aa20720f89e2fadc4f5bca977350fad0
nghttp2-debugsource-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 930162c2c58064d8ff25f7107695518ebe8fecd786ad2a4a894d52896fbabb78

Red Hat CodeReady Linux Builder for IBM z Systems 8

SRPM
s390x
libnghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 9acadef049eb47e65bad7d9322f8e0121f2fc10ba51d15c667ed33ff09d6072f
libnghttp2-devel-1.33.0-6.el8_10.3.s390x.rpm SHA-256: e017d4b1af8888368a40e4621b49a9648c1a2edec69658a94b072bab21ccb5d5
nghttp2-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 23c713dddd6778393d587d128bf463809ed2d15873d40eed7118839bcc4902a6
nghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 7c203d3f3e6c4ac72092608a6100940ee6bb781c1aa4b46343072788560e8bd0
nghttp2-debugsource-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 51cbbfd6a8b2dd29b77096f4cea183d91739d6440fae46e1c89de24a5cf33237

Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
x86_64
libnghttp2-1.33.0-6.el8_10.3.i686.rpm SHA-256: bf4d77d240fea68b4ed70496698ca567dcd48236695424329fd238357ee5a40c
libnghttp2-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 84133385c26f1ccb4da87df50b0a4dd19209dd440ea694eec4a3be55a1ade93a
libnghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: c495236a611659b49f2cb7ce6bcb87091f0d2fc3066bf6ccbddbda6bb41408eb
libnghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 598f65df61b3565dd93640a59d94201a30ccc722031a35d8cf71b1bedc0780e8
nghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: 10e485e3c7d2d6806782ca8773cecabda2fafb5db8a828346b4dbbb76b776f32
nghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: a566a7daacab48241709423d9a5139a66dfba0f5ad5176f9ed0a6e1253b1abbb
nghttp2-debugsource-1.33.0-6.el8_10.3.i686.rpm SHA-256: e4eb8eedd3bc9202b63fd028b8dd2e9493fa6a57080ceba00624aef61e7998f4
nghttp2-debugsource-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: db2ab1425b9e98cf6a6feadced86bf0ede2fd7df9f996ed22526dcc271cad7b0

Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
aarch64
libnghttp2-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 6f9e77e080174b36abadad04c2ea0149f3215448467ae97b9fe9f618b5eb96a0
libnghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 40002a82c0b73da91fbb6e9fa36bec83a17f95a36151bab3ce34de16de7b1459
nghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: d9f4f33e83ad67e7f3eb24175210c733aa20720f89e2fadc4f5bca977350fad0
nghttp2-debugsource-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 930162c2c58064d8ff25f7107695518ebe8fecd786ad2a4a894d52896fbabb78

Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
ppc64le
libnghttp2-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: 50405901574c4956bc014b2300256c859e73954a794d8fbcab24f9b86bba9858
libnghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: cac3095bc1a29ab64d64e1962737f301144144d7f7100cb9416c435e33496034
nghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: ebba5c372a77e95a73e902f5c0fc275f6deb69bf2d5ec37d24d4e2f222c61801
nghttp2-debugsource-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: b567fe1756a186f9f4e5eeca9a63865d0639100a30521b75a3ddea114a829498

Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10

SRPM
nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b
s390x
libnghttp2-1.33.0-6.el8_10.3.s390x.rpm SHA-256: d0e5288ff8e1471dd63541e0ed04b6c18cc256a8c8e6af20a5106cc887130a62
libnghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 9acadef049eb47e65bad7d9322f8e0121f2fc10ba51d15c667ed33ff09d6072f
nghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 7c203d3f3e6c4ac72092608a6100940ee6bb781c1aa4b46343072788560e8bd0
nghttp2-debugsource-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 51cbbfd6a8b2dd29b77096f4cea183d91739d6440fae46e1c89de24a5cf33237

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.