This advisory concerns a security vulnerability tracked as CVE-2026-58055 affecting the nghttp2 packages included in Red Hat Hardened Images RPMs. The update involves several nghttp2 RPMs (libnghttp2, libnghttp2-devel, mingw32-libnghttp2, mingw64-libnghttp2, and nghttp2) for aarch64 and x86_64 architectures. The vulnerability is associated with CWE-444, which relates to improper protection of system or configuration settings. The Red Hat advisory references updated RPMs with version 1.69.0-3.1.hum1 but does not explicitly state which versions are fixed or affected. No CVSS score is provided, and no known exploits have been reported. The vendor advisory does not explicitly mention a patch or remediation instructions beyond the availability of updated RPMs.

The vulnerability affects the nghttp2 packages in Red Hat Hardened Images RPMs, potentially allowing improper protection of system or configuration settings (CWE-444). The exact impact is not detailed in the advisory. No known exploits in the wild have been reported, indicating limited or no active exploitation at this time.

Red Hat has released updated RPM packages for nghttp2 as part of the Hardened Images security update. Users should apply these updates to remediate the vulnerability. Since the advisory does not explicitly state a fixed version or detailed patch instructions, users should follow Red Hat's official update procedures and consult https://images.redhat.com/ and https://access.redhat.com/errata/RHSA-2026:35454 for the latest guidance. No alternative mitigations or workarounds are provided.