Summary
USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04
LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the
corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04
LTS, and Ubuntu 14.04 LTS.
In addition, this update fixes CVE-2026-42533 for these releases.
It was discovered that nginx incorrectly handled certain map directives
using regex matching and capture variables. A remote attacker could
possibly use this issue to crash nginx, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2026-42533)
Original advisory details:
It was discovered that nginx incorrectly handled certain configurations
using the alias directive together with rewrite rules. A remote attacker
could possibly use this issue to cause nginx to crash, resulting in a
denial of service, or execute arbitrary code. (CVE-2026-15176)
It was discovered that nginx incorrectly handled map directives using
regex matching under certain circumstances. A remote attacker could
possibly use this issue to cause nginx to crash, resulting in a denial of
service, or execute arbitrary code. (CVE-2026-93479)
It was discovered that nginx incorrectly handled HTTP/3 requests when
proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04
LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to
inject data into proxied requests. (CVE-2026-95101)
It was discovered that nginx incorrectly handled asynchronous file I/O in
certain configurations with Server Side Includes pages. A remote attacker
could possibly use this issue to cause nginx to crash, resulting in a
denial of service, or execute arbitrary code. (CVE-2026-97205)
It was discovered that nginx incorrectly handled SSL session ticket keys
when configured with a shared session cache but without explicit ticket
key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,
and Ubuntu 26.10. A remote attacker could possibly use this issue to forge
client SSL sessions and bypass client certificate verification.
(CVE-2026-97629)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | nginx | 1.4.6-1ubuntu3.9+esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | nginx | 1.10.3-0ubuntu0.16.04.5+esm10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | nginx | 1.14.0-0ubuntu1.11+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | nginx | 1.18.0-0ubuntu1.7+esm4 |
Vulnerabilities 4
-
High 8.1CVE-2026-15176 Public exploit
NGINX ngx_http_core_module vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achi…
-
High 8.1CVE-2026-42533 Public exploit
NGINX Map directive and Regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achiev…
-
High 8.1
NGINX map directive and regex matching vulnerability
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. Alternatively, the same re…
-
High 8.1CVE-2026-97205 Public exploit
NGINX ngx_http_core_module vulnerability
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a U…