HTTP/2 Bomb nginx update

Security
1

Earlier this month a HTTP/2 vulnerability was disclosed, commonly referred to as HTTP/2 Bomb, that affects several web servers, including Apache/httpd (CVE-2026-49975) and nginx.

While Apache already received a mitigation update on June 5th, 2026, no update for nginx has been released yet, neither for AlmaLinux 10, 9 or 8.

Is there any information when a mitigation will be available for nginx?

2

Hello
For nginx package updates, please confirm directly with the AlmaLinux Core SIG on chat.almalinux.org.

They should have the most accurate information about backport status and package availability.
thanks

3

Hello, @OpiliOne

I apologize. I overlooked the Red Hat bulletin.

The AlmaLinux 10 nginx package appears to be available now in AppStream:

nginx.x86_64 2:1.26.3-6.el10_2.4 appstream

This also matches the package listed in ALSA-2026:29874.

The confusing point is that the HTTP/2 Bomb mitigation for nginx is documented in Red Hat bulletin RHSB-2026-007, while the AlmaLinux errata itself is listed under CVE-2026-9256.

References:

4

Thanks @redadmin for the info. Seems there are updates for AlmaLinux 10 (nginx 1.26.3 ), AlmaLinux 9 (nginx 1.26.3, 1.24.0, 1.20.1) and AlmaLinux 8 (nginx 1.24.0) available in the AppStream repo now.

However, I’m also waiting for an update for nginx 1.20.1 and 1.22.1 on AlmaLinux 8.
Do you have any information if or when updates are released for these nginx versions as well?

5

hi @OpiliOne

For AlmaLinux 8, nginx:1.24 looks like the supported stream now.

AlmaLinux 8.10 release notes list nginx 1.24:

Red Hat AppStream lifecycle shows nginx 1.20 and 1.22 are already EOL.

So I would recommend moving AlmaLinux 8 systems to nginx:1.24.

6

I see, but for AlmaLinux 9 nginx 1.26 is the currently supported stream:

https://wiki.almalinux.org/release-notes/9.6.html

AlmaLinux 9 still received an update for nginx 1.20.1, as written in my previos post.
So shouldn’t there be an AlmaLinux 8 update for nginx 1.20 as well?

7

Good point.

But I think the previous NGINX Rift case was an exceptional decision by AlmaLinux/ALESCo.

The AlmaLinux blog says:

Given the severity of NGINX Rift, ALESCo chose to backport the fix to every one of those end-of-life streams as well

So I don’t think the previous nginx:1.20 / nginx:1.22 updates necessarily mean those EOL streams will always receive future fixes.

For this HTTP/2 Bomb issue, I think someone from the AlmaLinux release/security team would need to confirm.