Ubuntu alert USN-8495-1 (nghttp2)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8495-1] nghttp2 vulnerability
Date:
             
 
Thu, 02 Jul 2026 14:23:20 +0000
Message-ID:
             
 
<E1wfIK0-0006E2-Lg@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8495-1
July 02, 2026

nghttp2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

nghttp2 could allow unintended access to network services.

Software Description:
- nghttp2: HTTP/2 C Library and tools

Details:

It was discovered that the nghttp2 nghttpx proxy incorrectly handled
HTTP/1.1 Upgrade requests that included a Content-Length header and body.
A remote attacker could possibly use this issue to perform HTTP request and
response smuggling attacks against backend services.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  nghttp2                         1.68.0-2ubuntu0.2

Ubuntu 25.10
  nghttp2                         1.64.0-1.1ubuntu1.2

Ubuntu 24.04 LTS
  nghttp2                         1.59.0-1ubuntu0.4

Ubuntu 22.04 LTS
  nghttp2                         1.43.0-1ubuntu0.4

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8495-1
  CVE-2026-58055

Package Information:
  https://launchpad.net/ubuntu/+source/nghttp2/1.68.0-2ubun...
  https://launchpad.net/ubuntu/+source/nghttp2/1.64.0-1.1ub...
  https://launchpad.net/ubuntu/+source/nghttp2/1.59.0-1ubun...
  https://launchpad.net/ubuntu/+source/nghttp2/1.43.0-1ubun...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmpGc1sACgkQcpJm3tlz
hgHD6w/+O/Vdqov9PT//ym/wml3UyH8Psypne6/exdvplHSvzm9axdkNwfhfcAIl
cjocjJMBeLoaMdnknPo+VgL0Wfi0caUlCRlrWiHYUyejdiirGDrP7NVcWeyqRjfI
qYMI1gI3gSoMYtLxRzIPlBX3uYQ9vLCSiQbzToZAmsfBubgxgj+iwBqe3QwCTzuR
3p0wlml6xiXHVdjkv++9nvJYGio3tgD3dXc3HcdT8OXNrBmg6KOBC6Us/nvogCKY
jy/1dGcMADudzadGvIhD9CXGUu20oAhFYjy/l4LwFyDG76FmWFXCvBBYyyPB212T
6tLIRuhzaPzGCoobQbAoaaSD/cjA20yaVPX5rVvKaw0oDczy620A+nllfvXm7Bxb
3AhZSP2sXXxQ08wyKwWY9GqbcvI9YhqvLrwyfyEnWlgUa3Gb+faaU1Aa9C/IUOSN
6MHD4kO+/esfmVqdJKbuqj2T3xhszJPD3dDhvVWQODaAsfevzuJTX5yp3MqZlR7U
swnK/VympHEOU+aMOtUQJxZrn6Y2Di5xfTr678nbYFng6leHb34YTnDIk4pQw7wN
p3a2Oqy7NWWw1iNu8dCwCBvOITHhfykpDDfKhKIYKd6pg/EofMYUA3ph9/oK8pDT
6Pcn3dIS0VDX8Ufe1g4ik0y6zVG+S10NzYLVq1ZBVTIjySP9qtA=
=JquJ
-----END PGP SIGNATURE-----