[Buildroot] [PATCH 1/1] package/nghttp2: security bump version to 1.70.0

[Buildroot] [PATCH 1/1] package/nghttp2: security bump version to 1.70.0

[Fiona Klute via buildroot]

CVE-2026-58055 [1]: nghttp2's nghttpx proxy through 1.69.0 forwards an
HTTP/1.1 Upgrade request that also carries a Content-Length header and
body onto reusable keep-alive backend connections, re-adding the
Upgrade and Connection headers while passing Content-Length
verbatim. A backend that resolves the resulting ambiguous message in
the attacker's favor enables HTTP request/response smuggling and
cross-client response-queue poisoning.

Upstream changelogs (no specific mentions of security):
https://github.com/nghttp2/nghttp2/releases/tag/v1.70.0
https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0

[1] https://nvd.nist.gov/vuln/detail/cve-2026-58055

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
---
@Bernd, maybe relevant for you: The changelog for 1.69.0 mentions
testing OpenSSL 4.0 in CI.

 package/nghttp2/nghttp2.hash | 2 +-
 package/nghttp2/nghttp2.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/nghttp2/nghttp2.hash b/package/nghttp2/nghttp2.hash
index 6af7b3eecb..f77eb6a67a 100644
--- a/package/nghttp2/nghttp2.hash
+++ b/package/nghttp2/nghttp2.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  6abd7ab0a7f1580d5914457cb3c85eb80455657ee5119206edbd7f848c14f0b2  nghttp2-1.68.1.tar.xz
+sha256  e05cb1388eaca3830aded4ccf20044b6e1ac1a61411dcca11b0437c4285c8bc2  nghttp2-1.70.0.tar.xz
 sha256  6b94f3abc1aabd0c72a7c7d92a77f79dda7c8a0cb3df839a97890b4116a2de2a  COPYING
diff --git a/package/nghttp2/nghttp2.mk b/package/nghttp2/nghttp2.mk
index 50b94582e1..7d02877561 100644
--- a/package/nghttp2/nghttp2.mk
+++ b/package/nghttp2/nghttp2.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-NGHTTP2_VERSION = 1.68.1
+NGHTTP2_VERSION = 1.70.0
 NGHTTP2_SOURCE =  nghttp2-$(NGHTTP2_VERSION).tar.xz
 NGHTTP2_SITE = https://github.com/nghttp2/nghttp2/releases/download/v$(NGHTTP2_VERSION)
 NGHTTP2_LICENSE = MIT
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/nghttp2: security bump version to 1.70.0

[Thomas Petazzoni via buildroot]

On Fri, Oct 23, 2026 at 01:53:28AM +0200, Fiona Klute via buildroot wrote:
> CVE-2026-58055 [1]: nghttp2's nghttpx proxy through 1.69.0 forwards an
> HTTP/1.1 Upgrade request that also carries a Content-Length header and
> body onto reusable keep-alive backend connections, re-adding the
> Upgrade and Connection headers while passing Content-Length
> verbatim. A backend that resolves the resulting ambiguous message in
> the attacker's favor enables HTTP request/response smuggling and
> cross-client response-queue poisoning.
> 
> Upstream changelogs (no specific mentions of security):
> https://github.com/nghttp2/nghttp2/releases/tag/v1.70.0
> https://github.com/nghttp2/nghttp2/releases/tag/v1.69.0
> 
> [1] https://nvd.nist.gov/vuln/detail/cve-2026-58055
> 
> Signed-off-by: Fiona Klute <fiona.klute@gmx.de>

Applied to master, thanks!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot