nghttp2 (1.43.0-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP request/response smuggling issue
    - debian/patches/CVE-2026-58055-pre1.patch: nghttpx: Remove trailing white
      spaces from HTTP/1.1 fields in src/shrpx-unittest.cc,
      src/shrpx_downstream.h, src/shrpx_http_downstream_connection.cc,
      src/shrpx_https_upstream.cc, src/util.cc, src/util.h, src/util_test.cc,
      src/util_test.h.
    - debian/patches/CVE-2026-58055-pre2.patch: nghttpx: Stricter transfer-
      encoding checks in integration-tests/nghttpx_http1_test.go, src/http2.cc,
      src/http2.h, src/http2_test.cc, src/http2_test.h, src/shrpx-unittest.cc,
      src/shrpx_downstream.cc, src/shrpx_http_downstream_connection.cc,
      src/shrpx_https_upstream.cc.
    - debian/patches/CVE-2026-58055.patch: nghttpx: Tighten up CONNECT and HTTP
      Upgrade handling in src/shrpx_downstream.cc, src/shrpx_downstream.h,
      src/shrpx_http2_upstream.cc, src/shrpx_http_downstream_connection.cc,
      src/shrpx_http_downstream_connection.h, src/shrpx_https_upstream.cc.
    - CVE-2026-58055

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 30 Jun 2026 13:21:48 -0400

nghttp2 (1.43.0-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: Denial of service through assertion failure.
    - debian/patches/CVE-2026-27135-pre1.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - debian/patches/CVE-2026-27135-pre2.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - debian/patches/CVE-2026-27135.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - debian/patches/CVE-2026-27135-post1.patch: Add iframe->state ==
      NGHTTP2_IB_IGN_ALL checks in lib/nghttp2_session.c.
    - CVE-2026-27135

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 28 Apr 2026 16:49:21 -0230

nghttp2 (1.43.0-1ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 protocol denial of service
    - debian/patches/CVE-2024-28182-1.patch: Add
      nghttp2_option_set_max_continuations
    - debian/patches/CVE-2024-28182-2.patch: Limit CONTINUATION frames
      following an incoming HEADER frame
    - CVE-2024-28182

 -- Fabian Toepfer <fabian.toepfer@canonical.com>  Thu, 18 Apr 2024 09:14:38 +0200

nghttp2 (1.43.0-1ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: HTTP/2 protocol denial of service
    - debian/patches/CVE-2023-44487.patch: implement stream reset rate
      limiting.
    - CVE-2023-44487

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 11 Oct 2023 13:50:35 -0400

nghttp2 (1.43.0-1build3) jammy; urgency=high

  * No change rebuild for ppc64el baseline bump.

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 24 Mar 2022 17:21:15 +0100

nghttp2 (1.43.0-1build2) jammy; urgency=medium

  * No-change rebuild against openssl3

 -- Simon Chopin <simon.chopin@canonical.com>  Wed, 01 Dec 2021 16:07:54 +0000

nghttp2 (1.43.0-1build1) impish; urgency=medium

  * No-change rebuild to build packages with zstd compression.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 07 Oct 2021 12:21:34 +0200

nghttp2 (1.43.0-1) unstable; urgency=medium

  * New upstream release 1.43.0

 -- Tomasz Buchert <tomasz@debian.org>  Sat, 13 Feb 2021 18:47:24 +0100

nghttp2 (1.42.0-1) unstable; urgency=medium

  * New upstream release 1.42.0
  * Refresh patches

 -- Tomasz Buchert <tomasz@debian.org>  Sat, 28 Nov 2020 16:41:28 +0100

nghttp2 (1.41.0-3) unstable; urgency=medium

  [ Jérémy Lal ]
  * not-installed with wildcard arch

  [ Tomasz Buchert ]
  * workaround for #963648

 -- Tomasz Buchert <tomasz@debian.org>  Sun, 16 Aug 2020 13:01:37 +0200

# For older changelog entries, run 'apt-get changelog libnghttp2-14'
