Red Hat Product Errata RHSA-2026:54650 - Security Advisory Issued: 2026-08-13 Updated: 2026-08-13 RHSA-2026:54650 - Security Advisory Overview Updated Packages Synopsis Moderate: nghttp2 security update Type/Severity Security Advisory: Moderate Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for nghttp2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat CodeReady Linux Builder for x86_64 10 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 10 ppc64le Red Hat CodeReady Linux Builder for ARM 64 10 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 10 s390x Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.2 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.2 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2493954 - CVE-2026-58055 nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVEs CVE-2026-58055 References https://access.redhat.com/security/updates/classification/#moderate Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM nghttp2-1.68.0-3.el10_2.2.src.rpm SHA-256: ad6a16153a63a85eccbbed3f11d21780bddcef374d42cfb5c61ab28fabcafbb8 x86_64 libnghttp2-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 3b2a80a595800a4086dc212b06e13aa54ca6552f157186582d8b255041812336 libnghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 36cd42673030e06ad6b51c24ced3007f4e70279e111788b07eb8e549b51c93f2 libnghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 36cd42673030e06ad6b51c24ced3007f4e70279e111788b07eb8e549b51c93f2 libnghttp2-devel-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 62cd715e514cb0e1017210ae7546b76ced0085d3895a3f232d649edd884e6835 nghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 5450f6afc9cedc0d3ce39a6245ab710f089745cbed921054b4ce0950b9e8df70 nghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 5450f6afc9cedc0d3ce39a6245ab710f089745cbed921054b4ce0950b9e8df70 nghttp2-debugsource-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: ed4c587e351098fd9b5127498e6636c3e0ba363c99975659c492ee30fa91ee24 nghttp2-debugsource-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: ed4c587e351098fd9b5127498e6636c3e0ba363c99975659c492ee30fa91ee24 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM nghttp2-1.68.0-3.el10_2.2.src.rpm SHA-256: ad6a16153a63a85eccbbed3f11d21780bddcef374d42cfb5c61ab28fabcafbb8 x86_64 libnghttp2-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 3b2a80a595800a4086dc212b06e13aa54ca6552f157186582d8b255041812336 libnghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 36cd42673030e06ad6b51c24ced3007f4e70279e111788b07eb8e549b51c93f2 libnghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 36cd42673030e06ad6b51c24ced3007f4e70279e111788b07eb8e549b51c93f2 libnghttp2-devel-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 62cd715e514cb0e1017210ae7546b76ced0085d3895a3f232d649edd884e6835 nghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 5450f6afc9cedc0d3ce39a6245ab710f089745cbed921054b4ce0950b9e8df70 nghttp2-debuginfo-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: 5450f6afc9cedc0d3ce39a6245ab710f089745cbed921054b4ce0950b9e8df70 nghttp2-debugsource-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: ed4c587e351098fd9b5127498e6636c3e0ba363c99975659c492ee30fa91ee24 nghttp2-debugsource-1.68.0-3.el10_2.2.x86_64.rpm SHA-256: ed4c587e351098fd9b5127498e6636c3e0ba363c99975659c492ee30fa91ee24 Red Hat Enterprise Linux for IBM z Systems 10 SRPM nghttp2-1.68.0-3.el10_2.2.src.rpm SHA-256: ad6a16153a63a85eccbbed3f11d21780bddcef374d42cfb5c61ab28fabcafbb8 s390x libnghttp2-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 34acad7d22eaf1a10a5552f8d1451183e55b1397a40cb0a0e72ed5d0e1a65cc9 libnghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 66624fd7fc990c17de08ee1b2b837d9601e918f4760715650c8a49e6bcc35b7f libnghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 66624fd7fc990c17de08ee1b2b837d9601e918f4760715650c8a49e6bcc35b7f libnghttp2-devel-1.68.0-3.el10_2.2.s390x.rpm SHA-256: a092430484a66e4beb089d399c17ade9940cf9cec05c6c2b1808fd18c6ecd73a nghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: a96479b10c7ac4503ef3c64e707a8b6850fc55a7e79dcd9155bc1645d835620c nghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: a96479b10c7ac4503ef3c64e707a8b6850fc55a7e79dcd9155bc1645d835620c nghttp2-debugsource-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 11001672a80a9578a953352ee6da88dc6acf4bf5ef79218a7a31cfe1afa7b2ce nghttp2-debugsource-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 11001672a80a9578a953352ee6da88dc6acf4bf5ef79218a7a31cfe1afa7b2ce Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM nghttp2-1.68.0-3.el10_2.2.src.rpm SHA-256: ad6a16153a63a85eccbbed3f11d21780bddcef374d42cfb5c61ab28fabcafbb8 s390x libnghttp2-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 34acad7d22eaf1a10a5552f8d1451183e55b1397a40cb0a0e72ed5d0e1a65cc9 libnghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 66624fd7fc990c17de08ee1b2b837d9601e918f4760715650c8a49e6bcc35b7f libnghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 66624fd7fc990c17de08ee1b2b837d9601e918f4760715650c8a49e6bcc35b7f libnghttp2-devel-1.68.0-3.el10_2.2.s390x.rpm SHA-256: a092430484a66e4beb089d399c17ade9940cf9cec05c6c2b1808fd18c6ecd73a nghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: a96479b10c7ac4503ef3c64e707a8b6850fc55a7e79dcd9155bc1645d835620c nghttp2-debuginfo-1.68.0-3.el10_2.2.s390x.rpm SHA-256: a96479b10c7ac4503ef3c64e707a8b6850fc55a7e79dcd9155bc1645d835620c nghttp2-debugsource-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 11001672a80a9578a953352ee6da88dc6acf4bf5ef79218a7a31cfe1afa7b2ce nghttp2-debugsource-1.68.0-3.el10_2.2.s390x.rpm SHA-256: 11001672a80a9578a953352ee6da88dc6acf4bf5ef79218a7a31cfe1afa7b2ce Red Hat Enterprise Linux for Power, little endian 10 SRPM nghttp2-1.68.0-3.el10_2.2.src.rpm SHA-256: ad6a16153a63a85eccbbed3f11d21780bddcef374d42cfb5c61ab28fabcafbb8 ppc64le libnghttp2-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 905ec04df29d6d52246a89dad83e0f6ede4e661f2598f5f2668a504827f93a44 libnghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 7f28f003f24abc8c0f4f890c11245c92c47e585fc40207a3fb1c3a28bc51f851 libnghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 7f28f003f24abc8c0f4f890c11245c92c47e585fc40207a3fb1c3a28bc51f851 libnghttp2-devel-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 1900a1e9686d97ec7480e48aa4d6e81d7ec9aa97729c2deee7d95ef15b03eed4 nghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 891d20b73bab72d6a2a6b043549ea05137eed30eb6f69b5618be9c54a692e421 nghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 891d20b73bab72d6a2a6b043549ea05137eed30eb6f69b5618be9c54a692e421 nghttp2-debugsource-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 30d12b11eb2324f9ce03aa389896ceeeef1b2be7c7c74e48163b2be0b4a9f0d3 nghttp2-debugsource-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 30d12b11eb2324f9ce03aa389896ceeeef1b2be7c7c74e48163b2be0b4a9f0d3 Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM nghttp2-1.68.0-3.el10_2.2.src.rpm SHA-256: ad6a16153a63a85eccbbed3f11d21780bddcef374d42cfb5c61ab28fabcafbb8 ppc64le libnghttp2-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 905ec04df29d6d52246a89dad83e0f6ede4e661f2598f5f2668a504827f93a44 libnghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 7f28f003f24abc8c0f4f890c11245c92c47e585fc40207a3fb1c3a28bc51f851 libnghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 7f28f003f24abc8c0f4f890c11245c92c47e585fc40207a3fb1c3a28bc51f851 libnghttp2-devel-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 1900a1e9686d97ec7480e48aa4d6e81d7ec9aa97729c2deee7d95ef15b03eed4 nghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 891d20b73bab72d6a2a6b043549ea05137eed30eb6f69b5618be9c54a692e421 nghttp2-debuginfo-1.68.0-3.el10_2.2.ppc64le.rpm SHA-256: 891d20b73bab72d