ELSA-2026-54650

ELSA-2026-54650 - nghttp2 security update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2026-08-13

Description

[1.68.0-3.2]
- fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

Related CVEs

CVE-2026-58055

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_aarch64_appstream
	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_aarch64_baseos_latest
	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_aarch64_codeready_builder
	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_aarch64_u2_baseos_patch
	libnghttp2-1.68.0-3.el10_2.2.aarch64.rpm	29ab70ee06587833e62f7d62d2d7ed8c366aaaba03a25e8f55f9ccfd76e08bae	-	ol10_aarch64_baseos_latest
	libnghttp2-1.68.0-3.el10_2.2.aarch64.rpm	29ab70ee06587833e62f7d62d2d7ed8c366aaaba03a25e8f55f9ccfd76e08bae	-	ol10_aarch64_u2_baseos_patch
	libnghttp2-devel-1.68.0-3.el10_2.2.aarch64.rpm	d90676f1e996f80c8c68b3f0a84722e2a14c1ffa4281c1e25c5750c486e92233	-	ol10_aarch64_appstream
	nghttp2-1.68.0-3.el10_2.2.aarch64.rpm	fd5b37a5326c443a8c857798b0aca359987056395cb84855e0d61a9129dd43dd	-	ol10_aarch64_codeready_builder
Oracle Linux 10 (x86_64)	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_x86_64_appstream
	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_x86_64_baseos_latest
	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_x86_64_codeready_builder
	nghttp2-1.68.0-3.el10_2.2.src.rpm	c187d7e708aa2a39c4df1068ac604f6851c5735d80d030b7600b7676edd79c74	-	ol10_x86_64_u2_baseos_patch
	libnghttp2-1.68.0-3.el10_2.2.x86_64.rpm	24f91394a31177b1c1829f626c0a4f77ec47a61f47b9e5f580ba5a2c0f46fd5b	-	ol10_x86_64_baseos_latest
	libnghttp2-1.68.0-3.el10_2.2.x86_64.rpm	24f91394a31177b1c1829f626c0a4f77ec47a61f47b9e5f580ba5a2c0f46fd5b	-	ol10_x86_64_u2_baseos_patch
	libnghttp2-devel-1.68.0-3.el10_2.2.x86_64.rpm	b439352924d4818ab890f2cb09a7a61bf8953b5afa861ebad6e331ed8f492650	-	ol10_x86_64_appstream
	nghttp2-1.68.0-3.el10_2.2.x86_64.rpm	cd2f1031e0cd7301e50022de653bb42ab2255990f2423ee61aba001ba8924052	-	ol10_x86_64_codeready_builder

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team