Ubuntu 26.04 LTS nghttp2 Important Network Access Vulnerability USN-8495-1

ubuntu

July 2, 2026

nghttp2 could allow unintended access to network services.

Summary

nghttp2 could allow unintended access to network services.

Software Description:

- nghttp2: HTTP/2 C Library and tools

Details:

It was discovered that the nghttp2 nghttpx proxy incorrectly handled

HTTP/1.1 Upgrade requests that included a Content-Length header and body.

A remote attacker could possibly use this issue to perform HTTP request and

response smuggling attacks against backend services.

Topics Covered

security advisory Ubuntu important HTTP request network access nghttp2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  nghttp2                         1.68.0-2ubuntu0.2

Ubuntu 25.10
  nghttp2                         1.64.0-1.1ubuntu1.2

Ubuntu 24.04 LTS
  nghttp2                         1.59.0-1ubuntu0.4

Ubuntu 22.04 LTS
  nghttp2                         1.43.0-1ubuntu0.4

In general, a standard system update will make all the necessary changes.