Red Hat Product Errata RHSA-2026:55804 - Security Advisory Issued: 2026-08-17 Updated: 2026-08-17 RHSA-2026:55804 - Security Advisory Overview Updated Packages Synopsis Moderate: nghttp2 security update Type/Severity Security Advisory: Moderate Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for nghttp2 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for x86_64 8 x86_64 Red Hat CodeReady Linux Builder for Power, little endian 8 ppc64le Red Hat CodeReady Linux Builder for ARM 64 8 aarch64 Red Hat CodeReady Linux Builder for IBM z Systems 8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2493954 - CVE-2026-58055 nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVEs CVE-2026-58055 References https://access.redhat.com/security/updates/classification/#moderate Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b x86_64 libnghttp2-1.33.0-6.el8_10.3.i686.rpm SHA-256: bf4d77d240fea68b4ed70496698ca567dcd48236695424329fd238357ee5a40c libnghttp2-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 84133385c26f1ccb4da87df50b0a4dd19209dd440ea694eec4a3be55a1ade93a libnghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: c495236a611659b49f2cb7ce6bcb87091f0d2fc3066bf6ccbddbda6bb41408eb libnghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 598f65df61b3565dd93640a59d94201a30ccc722031a35d8cf71b1bedc0780e8 nghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: 10e485e3c7d2d6806782ca8773cecabda2fafb5db8a828346b4dbbb76b776f32 nghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: a566a7daacab48241709423d9a5139a66dfba0f5ad5176f9ed0a6e1253b1abbb nghttp2-debugsource-1.33.0-6.el8_10.3.i686.rpm SHA-256: e4eb8eedd3bc9202b63fd028b8dd2e9493fa6a57080ceba00624aef61e7998f4 nghttp2-debugsource-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: db2ab1425b9e98cf6a6feadced86bf0ede2fd7df9f996ed22526dcc271cad7b0 Red Hat Enterprise Linux for IBM z Systems 8 SRPM nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b s390x libnghttp2-1.33.0-6.el8_10.3.s390x.rpm SHA-256: d0e5288ff8e1471dd63541e0ed04b6c18cc256a8c8e6af20a5106cc887130a62 libnghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 9acadef049eb47e65bad7d9322f8e0121f2fc10ba51d15c667ed33ff09d6072f nghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 7c203d3f3e6c4ac72092608a6100940ee6bb781c1aa4b46343072788560e8bd0 nghttp2-debugsource-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 51cbbfd6a8b2dd29b77096f4cea183d91739d6440fae46e1c89de24a5cf33237 Red Hat Enterprise Linux for Power, little endian 8 SRPM nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b ppc64le libnghttp2-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: 50405901574c4956bc014b2300256c859e73954a794d8fbcab24f9b86bba9858 libnghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: cac3095bc1a29ab64d64e1962737f301144144d7f7100cb9416c435e33496034 nghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: ebba5c372a77e95a73e902f5c0fc275f6deb69bf2d5ec37d24d4e2f222c61801 nghttp2-debugsource-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: b567fe1756a186f9f4e5eeca9a63865d0639100a30521b75a3ddea114a829498 Red Hat Enterprise Linux for ARM 64 8 SRPM nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b aarch64 libnghttp2-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 6f9e77e080174b36abadad04c2ea0149f3215448467ae97b9fe9f618b5eb96a0 libnghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 40002a82c0b73da91fbb6e9fa36bec83a17f95a36151bab3ce34de16de7b1459 nghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: d9f4f33e83ad67e7f3eb24175210c733aa20720f89e2fadc4f5bca977350fad0 nghttp2-debugsource-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 930162c2c58064d8ff25f7107695518ebe8fecd786ad2a4a894d52896fbabb78 Red Hat CodeReady Linux Builder for x86_64 8 SRPM x86_64 libnghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: c495236a611659b49f2cb7ce6bcb87091f0d2fc3066bf6ccbddbda6bb41408eb libnghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 598f65df61b3565dd93640a59d94201a30ccc722031a35d8cf71b1bedc0780e8 libnghttp2-devel-1.33.0-6.el8_10.3.i686.rpm SHA-256: a3c86a22b9dca784bd15685044f72e6519f2900f0b4b2d1c8cf9953d65292884 libnghttp2-devel-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: b73d1117b7f0af2f5ec70c052ef9689f762802a2eef0195021bc52930f55df19 nghttp2-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 799792772215302a7fc0420eca473ce0ddde02db6a327c78014ad474006f7208 nghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: 10e485e3c7d2d6806782ca8773cecabda2fafb5db8a828346b4dbbb76b776f32 nghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: a566a7daacab48241709423d9a5139a66dfba0f5ad5176f9ed0a6e1253b1abbb nghttp2-debugsource-1.33.0-6.el8_10.3.i686.rpm SHA-256: e4eb8eedd3bc9202b63fd028b8dd2e9493fa6a57080ceba00624aef61e7998f4 nghttp2-debugsource-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: db2ab1425b9e98cf6a6feadced86bf0ede2fd7df9f996ed22526dcc271cad7b0 Red Hat CodeReady Linux Builder for Power, little endian 8 SRPM ppc64le libnghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: cac3095bc1a29ab64d64e1962737f301144144d7f7100cb9416c435e33496034 libnghttp2-devel-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: 101b137e24539846d6981e27724406d86aacaaf98aa28236da488747ba8654ea nghttp2-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: aa108a685b90d7529df1ae20c918f28706da3e54d6a3134c8f232ef8804ca7d8 nghttp2-debuginfo-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: ebba5c372a77e95a73e902f5c0fc275f6deb69bf2d5ec37d24d4e2f222c61801 nghttp2-debugsource-1.33.0-6.el8_10.3.ppc64le.rpm SHA-256: b567fe1756a186f9f4e5eeca9a63865d0639100a30521b75a3ddea114a829498 Red Hat CodeReady Linux Builder for ARM 64 8 SRPM aarch64 libnghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 40002a82c0b73da91fbb6e9fa36bec83a17f95a36151bab3ce34de16de7b1459 libnghttp2-devel-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: af5a8af706f84018561755b7e63d5596ed50eea044c6ae23a7e5f24cfaf9fd22 nghttp2-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 0741afa37925b345b3b6ccae776667ff5be2185b54a35eaf81205bc58dda9ffd nghttp2-debuginfo-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: d9f4f33e83ad67e7f3eb24175210c733aa20720f89e2fadc4f5bca977350fad0 nghttp2-debugsource-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 930162c2c58064d8ff25f7107695518ebe8fecd786ad2a4a894d52896fbabb78 Red Hat CodeReady Linux Builder for IBM z Systems 8 SRPM s390x libnghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 9acadef049eb47e65bad7d9322f8e0121f2fc10ba51d15c667ed33ff09d6072f libnghttp2-devel-1.33.0-6.el8_10.3.s390x.rpm SHA-256: e017d4b1af8888368a40e4621b49a9648c1a2edec69658a94b072bab21ccb5d5 nghttp2-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 23c713dddd6778393d587d128bf463809ed2d15873d40eed7118839bcc4902a6 nghttp2-debuginfo-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 7c203d3f3e6c4ac72092608a6100940ee6bb781c1aa4b46343072788560e8bd0 nghttp2-debugsource-1.33.0-6.el8_10.3.s390x.rpm SHA-256: 51cbbfd6a8b2dd29b77096f4cea183d91739d6440fae46e1c89de24a5cf33237 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b x86_64 libnghttp2-1.33.0-6.el8_10.3.i686.rpm SHA-256: bf4d77d240fea68b4ed70496698ca567dcd48236695424329fd238357ee5a40c libnghttp2-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 84133385c26f1ccb4da87df50b0a4dd19209dd440ea694eec4a3be55a1ade93a libnghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: c495236a611659b49f2cb7ce6bcb87091f0d2fc3066bf6ccbddbda6bb41408eb libnghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: 598f65df61b3565dd93640a59d94201a30ccc722031a35d8cf71b1bedc0780e8 nghttp2-debuginfo-1.33.0-6.el8_10.3.i686.rpm SHA-256: 10e485e3c7d2d6806782ca8773cecabda2fafb5db8a828346b4dbbb76b776f32 nghttp2-debuginfo-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: a566a7daacab48241709423d9a5139a66dfba0f5ad5176f9ed0a6e1253b1abbb nghttp2-debugsource-1.33.0-6.el8_10.3.i686.rpm SHA-256: e4eb8eedd3bc9202b63fd028b8dd2e9493fa6a57080ceba00624aef61e7998f4 nghttp2-debugsource-1.33.0-6.el8_10.3.x86_64.rpm SHA-256: db2ab1425b9e98cf6a6feadced86bf0ede2fd7df9f996ed22526dcc271cad7b0 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM nghttp2-1.33.0-6.el8_10.3.src.rpm SHA-256: aee4773680b3f381e0335980ae1be0093b88cf2a537513c105378e4c3b8d492b aarch64 libnghttp2-1.33.0-6.el8_10.3.aarch64.rpm SHA-256: 6f9e77e08