CVE-2026-58055 is a vulnerability in nghttp2's nghttpx proxy component that enables HTTP request smuggling and response-queue poisoning via ambiguous handling of HTTP/1.1 Upgrade requests containing a Content-Length header. The proxy forwards such requests to reusable keep-alive backend connections ambiguously, allowing an attacker to poison responses across clients. This flaw is rated moderate severity due to the high attack complexity required for successful exploitation. The vulnerability affects Red Hat Hardened Images RPMs including libnghttp2 version 1.69.0-3.1.hum1 on architectures aarch64 and x86_64. Red Hat recommends mitigation by configuring edge devices to drop HTTP/1.1 requests with both Upgrade and Content-Length headers. No explicit patch or official fix release is confirmed in the advisory, but updated RPMs including this fix are referenced. The CVE is associated with CWE-444 (Inconsistent Interpretation of HTTP Requests).

Successful exploitation could allow an attacker to perform HTTP request smuggling and cross-client response poisoning, potentially leading to integrity and confidentiality impacts such as web cache poisoning, firewall bypass, and unauthorized access to web applications. However, exploitation requires high attack complexity and no privileges or user interaction. Availability is not impacted. The flaw affects the proxy's handling of HTTP/1.1 Upgrade requests with Content-Length headers, causing ambiguous forwarding to backend connections.

Red Hat advises configuring your web application firewall (WAF) or load balancer to drop incoming HTTP/1.1 requests that contain both Upgrade and Content-Length headers. This mitigation blocks malformed traffic at the network edge before it reaches the vulnerable proxy, without impacting legitimate users. Users should monitor Red Hat advisories for updated RPMs and apply them when available. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.