Summary
It was discovered that nginx incorrectly handled large headers when
proxying HTTP/2 traffic. A remote attacker could use this issue to cause
nginx to crash, resulting in a denial of service, or possibly execute
arbitrary code. The default compiler options for affected releases should
reduce the vulnerability to a denial of service. (CVE-2026-42055)
It was discovered that nginx incorrectly handled character set conversion
under certain circumstances. A remote attacker could possibly use this
issue to obtain sensitive information or cause nginx to crash, resulting in
a denial of service. (CVE-2026-48142)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | nginx | 1.18.0-6ubuntu14.16 |
| Ubuntu · 24.04 LTS 24.04:LTS | nginx | 1.24.0-2ubuntu7.13 |
| Ubuntu · 25.10 | nginx | 1.28.0-6ubuntu1.8 |
| Ubuntu · 26.04 LTS 26.04:LTS | nginx | 1.28.3-2ubuntu1.6 |