{"id":"USN-8955-2","summary":"nginx vulnerabilities","details":"USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04\nLTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the\ncorresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04\nLTS, and Ubuntu 14.04 LTS.\n\nIn addition, this update fixes CVE-2026-42533 for these releases.\n\nIt was discovered that nginx incorrectly handled certain map directives\nusing regex matching and capture variables. A remote attacker could\npossibly use this issue to crash nginx, resulting in a denial of\nservice, or possibly execute arbitrary code. (CVE-2026-42533)\n\nOriginal advisory details:\n\n It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.  (CVE-2026-15176)\n\n It was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial  of\nservice, or execute arbitrary code.  (CVE-2026-93479)\n\n It was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected  Ubuntu 26.04\nLTS and Ubuntu 26.10. A remote attacker could possibly use  this issue to\ninject data into proxied requests.  (CVE-2026-95101)\n\n It was discovered that nginx incorrectly handled asynchronous file I/O  in\ncertain configurations with Server Side Includes pages. A remote  attacker\ncould possibly use this issue to cause nginx to crash,  resulting in a\ndenial of service, or execute arbitrary code.  (CVE-2026-97205)\n\n It was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker  could possibly use this issue to forge\nclient SSL sessions and bypass  client certificate verification.\n(CVE-2026-97629)","modified":"2026-11-06T01:13:08.896367466Z","published":"2026-11-05T14:40:26Z","related":["UBUNTU-CVE-2026-15176","UBUNTU-CVE-2026-42533","UBUNTU-CVE-2026-93479","UBUNTU-CVE-2026-97205"],"upstream":["CVE-2026-15176","CVE-2026-42533","CVE-2026-93479","CVE-2026-97205","UBUNTU-CVE-2026-15176","UBUNTU-CVE-2026-42533","UBUNTU-CVE-2026-93479","UBUNTU-CVE-2026-97205"],"references":[{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-8955-2"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-15176"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-42533"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-93479"},{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-97205"}],"affected":[{"package":{"name":"nginx","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra-legacy%2Ftrusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-1ubuntu3.9+esm9"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro","binaries":[{"binary_version":"1.4.6-1ubuntu3.9+esm9","binary_name":"nginx"},{"binary_version":"1.4.6-1ubuntu3.9+esm9","binary_name":"nginx-common"},{"binary_version":"1.4.6-1ubuntu3.9+esm9","binary_name":"nginx-core"},{"binary_name":"nginx-extras","binary_version":"1.4.6-1ubuntu3.9+esm9"},{"binary_name":"nginx-full","binary_version":"1.4.6-1ubuntu3.9+esm9"},{"binary_name":"nginx-light","binary_version":"1.4.6-1ubuntu3.9+esm9"},{"binary_version":"1.4.6-1ubuntu3.9+esm9","binary_name":"nginx-naxsi"},{"binary_name":"nginx-naxsi-ui","binary_version":"1.4.6-1ubuntu3.9+esm9"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8955-2.json","cves_map":{"ecosystem":"Ubuntu:Pro:14.04:LTS","cves":[{"id":"CVE-2026-15176","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-42533","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"score":"medium","type":"Ubuntu"}],"id":"CVE-2026-93479"},{"id":"CVE-2026-97205","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"score":"medium","type":"Ubuntu"}]}]}}},{"package":{"name":"nginx","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra-legacy%2Fxenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm10"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2","1.10.3-0ubuntu0.16.04.5+esm3","1.10.3-0ubuntu0.16.04.5+esm4","1.10.3-0ubuntu0.16.04.5+esm5","1.10.3-0ubuntu0.16.04.5+esm6","1.10.3-0ubuntu0.16.04.5+esm7","1.10.3-0ubuntu0.16.04.5+esm9"],"ecosystem_specific":{"binaries":[{"binary_name":"nginx","binary_version":"1.10.3-0ubuntu0.16.04.5+esm10"},{"binary_name":"nginx-common","binary_version":"1.10.3-0ubuntu0.16.04.5+esm10"},{"binary_name":"nginx-core","binary_version":"1.10.3-0ubuntu0.16.04.5+esm10"},{"binary_name":"nginx-extras","binary_version":"1.10.3-0ubuntu0.16.04.5+esm10"},{"binary_version":"1.10.3-0ubuntu0.16.04.5+esm10","binary_name":"nginx-full"},{"binary_name":"nginx-light","binary_version":"1.10.3-0ubuntu0.16.04.5+esm10"}],"availability":"Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"},"database_specific":{"cves_map":{"ecosystem":"Ubuntu:Pro:16.04:LTS","cves":[{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-15176"},{"id":"CVE-2026-42533","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-93479"},{"id":"CVE-2026-97205","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}]}]},"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8955-2.json"}},{"package":{"name":"nginx","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra%2Fbionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.11+esm5"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9","1.14.0-0ubuntu1.10","1.14.0-0ubuntu1.11","1.14.0-0ubuntu1.11+esm1","1.14.0-0ubuntu1.11+esm2","1.14.0-0ubuntu1.11+esm4"],"ecosystem_specific":{"binaries":[{"binary_name":"libnginx-mod-http-auth-pam","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-cache-purge","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-dav-ext","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-echo","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-fancyindex","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_version":"1.14.0-0ubuntu1.11+esm5","binary_name":"libnginx-mod-http-geoip"},{"binary_name":"libnginx-mod-http-headers-more-filter","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-image-filter","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-lua","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-ndk","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-perl","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-subs-filter","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_version":"1.14.0-0ubuntu1.11+esm5","binary_name":"libnginx-mod-http-uploadprogress"},{"binary_name":"libnginx-mod-http-upstream-fair","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-http-xslt-filter","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_version":"1.14.0-0ubuntu1.11+esm5","binary_name":"libnginx-mod-mail"},{"binary_name":"libnginx-mod-nchan","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-rtmp","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"libnginx-mod-stream","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_version":"1.14.0-0ubuntu1.11+esm5","binary_name":"nginx"},{"binary_name":"nginx-common","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_name":"nginx-core","binary_version":"1.14.0-0ubuntu1.11+esm5"},{"binary_version":"1.14.0-0ubuntu1.11+esm5","binary_name":"nginx-extras"},{"binary_version":"1.14.0-0ubuntu1.11+esm5","binary_name":"nginx-full"},{"binary_name":"nginx-light","binary_version":"1.14.0-0ubuntu1.11+esm5"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8955-2.json","cves_map":{"ecosystem":"Ubuntu:Pro:18.04:LTS","cves":[{"id":"CVE-2026-15176","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-42533","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}]},{"id":"CVE-2026-93479","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"score":"medium","type":"Ubuntu"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-97205"}]}}},{"package":{"name":"nginx","ecosystem":"Ubuntu:Pro:20.04:LTS","purl":"pkg:deb/ubuntu/nginx?arch=source&distro=esm-infra%2Ffocal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.7+esm4"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2","1.18.0-0ubuntu1.3","1.18.0-0ubuntu1.4","1.18.0-0ubuntu1.5","1.18.0-0ubuntu1.6","1.18.0-0ubuntu1.7","1.18.0-0ubuntu1.7+esm1","1.18.0-0ubuntu1.7+esm3"],"ecosystem_specific":{"binaries":[{"binary_name":"libnginx-mod-http-auth-pam","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_name":"libnginx-mod-http-cache-purge","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_name":"libnginx-mod-http-dav-ext","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-echo"},{"binary_name":"libnginx-mod-http-fancyindex","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-geoip"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-geoip2"},{"binary_name":"libnginx-mod-http-headers-more-filter","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_name":"libnginx-mod-http-image-filter","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_name":"libnginx-mod-http-lua","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-ndk"},{"binary_name":"libnginx-mod-http-perl","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-subs-filter"},{"binary_name":"libnginx-mod-http-uploadprogress","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-upstream-fair"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-http-xslt-filter"},{"binary_name":"libnginx-mod-mail","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-nchan"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-rtmp"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"libnginx-mod-stream"},{"binary_name":"nginx","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_name":"nginx-common","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_name":"nginx-core","binary_version":"1.18.0-0ubuntu1.7+esm4"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"nginx-extras"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"nginx-full"},{"binary_version":"1.18.0-0ubuntu1.7+esm4","binary_name":"nginx-light"}],"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8955-2.json","cves_map":{"cves":[{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-15176"},{"id":"CVE-2026-42533","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"score":"medium","type":"Ubuntu"}]},{"id":"CVE-2026-93479","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","type":"CVSS_V4"},{"type":"Ubuntu","score":"medium"}]},{"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},{"type":"Ubuntu","score":"medium"}],"id":"CVE-2026-97205"}],"ecosystem":"Ubuntu:Pro:20.04:LTS"}}}],"schema_version":"1.9.2"}