Cette page suit l'état du correctif pour Alpine Linux. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-58055 →
ALPINE-CVE-2026-58055
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-aliv...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
nghttp2's nghttpx proxy through 1.69.0 forwards an HTTP/1.1 Upgrade request that also carries a Content-Length header and body onto reusable keep-alive backend connections, re-adding the Upgrade and Connection headers while passing Content-Length verbatim. A backend that resolves the resulting ambiguous message in the attacker's favor enables HTTP request/response smuggling and cross-client response-queue poisoning.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Alpine:v3.24
nghttp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.70.0-r0"}]}]
Références
- advisory security.alpinelinux.org