Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
nghttpx Proxy Fails to Validate HTTP Upgrade Requests
published 3 months ago
Summary
The nghttpx proxy, used with nghttp2 versions up to 1.69.0, may allow attackers to manipulate HTTP requests and responses. This can lead to security issues, including the ability to inject malicious content into other users' sessions. We recommend updating to a newer version of nghttp2 to fix this issue.
What to do
- Update juliabinarywrappers nghttp2_jll to version 1.70.0+0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Julia | juliabinarywrappers | nghttp2_jll |
< 1.70.0+0 Fix: upgrade to 1.70.0+0
|
Original advisory text
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a...
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
References
- https://github.com/advisories/GHSA-xrr7-82jr-v58x URL
- https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-p... URL
- https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e... URL
- https://nvd.nist.gov/vuln/detail/CVE-2026-58055 URL
- https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smugg... URL
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published3 Aug 2026
Updated3 Aug 2026
First seen3 Aug 2026
Sources
JLSEC-2026-1157 · OSV
Track software like this
Free during beta