USN-8458-1: nginx vulnerabilities

Published Jun 22, 2026
·
Updated

It was discovered that nginx incorrectly handled large headers when proxying HTTP/2 traffic. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service. (CVE-2026-42055) It was discovered that nginx incorrectly handled character set conversion under certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-48142)

Affected Software

40 affected componentsFixes available
All of the following
ubuntu/nginx<1.28.3-2ubuntu1.6
1.28.3-2ubuntu1.6
Ubuntu Ubuntu=26.04
All of the following
ubuntu/nginx-core<1.28.3-2ubuntu1.6
1.28.3-2ubuntu1.6
Ubuntu Ubuntu=26.04
All of the following
ubuntu/nginx-extras<1.28.3-2ubuntu1.6
1.28.3-2ubuntu1.6
Ubuntu Ubuntu=26.04
All of the following
ubuntu/nginx-full<1.28.3-2ubuntu1.6
1.28.3-2ubuntu1.6
Ubuntu Ubuntu=26.04
All of the following
ubuntu/nginx-light<1.28.3-2ubuntu1.6
1.28.3-2ubuntu1.6
Ubuntu Ubuntu=26.04
All of the following
ubuntu/nginx<1.28.0-6ubuntu1.8
1.28.0-6ubuntu1.8
Ubuntu Ubuntu=25.10
All of the following
ubuntu/nginx-core<1.28.0-6ubuntu1.8
1.28.0-6ubuntu1.8
Ubuntu Ubuntu=25.10
All of the following
ubuntu/nginx-extras<1.28.0-6ubuntu1.8
1.28.0-6ubuntu1.8
Ubuntu Ubuntu=25.10
All of the following
ubuntu/nginx-full<1.28.0-6ubuntu1.8
1.28.0-6ubuntu1.8
Ubuntu Ubuntu=25.10
All of the following
ubuntu/nginx-light<1.28.0-6ubuntu1.8
1.28.0-6ubuntu1.8
Ubuntu Ubuntu=25.10
All of the following
ubuntu/nginx<1.24.0-2ubuntu7.13
1.24.0-2ubuntu7.13
Ubuntu Ubuntu=24.04
All of the following
ubuntu/nginx-core<1.24.0-2ubuntu7.13
1.24.0-2ubuntu7.13
Ubuntu Ubuntu=24.04
All of the following
ubuntu/nginx-extras<1.24.0-2ubuntu7.13
1.24.0-2ubuntu7.13
Ubuntu Ubuntu=24.04
All of the following
ubuntu/nginx-full<1.24.0-2ubuntu7.13
1.24.0-2ubuntu7.13
Ubuntu Ubuntu=24.04
All of the following
ubuntu/nginx-light<1.24.0-2ubuntu7.13
1.24.0-2ubuntu7.13
Ubuntu Ubuntu=24.04
All of the following
ubuntu/nginx<1.18.0-6ubuntu14.16
1.18.0-6ubuntu14.16
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-core<1.18.0-6ubuntu14.16
1.18.0-6ubuntu14.16
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-extras<1.18.0-6ubuntu14.16
1.18.0-6ubuntu14.16
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-full<1.18.0-6ubuntu14.16
1.18.0-6ubuntu14.16
Ubuntu Ubuntu=22.04
All of the following
ubuntu/nginx-light<1.18.0-6ubuntu14.16
1.18.0-6ubuntu14.16
Ubuntu Ubuntu=22.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/nginx to a version that resolves this vulnerability.

    Fixed in 1.28.3-2ubuntu1.6
  2. Upgrade

    Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.

    Fixed in 1.28.3-2ubuntu1.6
  3. Upgrade

    Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.

    Fixed in 1.28.3-2ubuntu1.6
  4. Upgrade

    Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.

    Fixed in 1.28.3-2ubuntu1.6
  5. Upgrade

    Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.

    Fixed in 1.28.3-2ubuntu1.6
  6. Upgrade

    Upgrade ubuntu/nginx to a version that resolves this vulnerability.

    Fixed in 1.28.0-6ubuntu1.8
  7. Upgrade

    Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.

    Fixed in 1.28.0-6ubuntu1.8
  8. Upgrade

    Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.

    Fixed in 1.28.0-6ubuntu1.8
  9. Upgrade

    Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.

    Fixed in 1.28.0-6ubuntu1.8
  10. Upgrade

    Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.

    Fixed in 1.28.0-6ubuntu1.8
  11. Upgrade

    Upgrade ubuntu/nginx to a version that resolves this vulnerability.

    Fixed in 1.24.0-2ubuntu7.13
  12. Upgrade

    Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.

    Fixed in 1.24.0-2ubuntu7.13
  13. Upgrade

    Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.

    Fixed in 1.24.0-2ubuntu7.13
  14. Upgrade

    Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.

    Fixed in 1.24.0-2ubuntu7.13
  15. Upgrade

    Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.

    Fixed in 1.24.0-2ubuntu7.13
  16. Upgrade

    Upgrade ubuntu/nginx to a version that resolves this vulnerability.

    Fixed in 1.18.0-6ubuntu14.16
  17. Upgrade

    Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.

    Fixed in 1.18.0-6ubuntu14.16
  18. Upgrade

    Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.

    Fixed in 1.18.0-6ubuntu14.16
  19. Upgrade

    Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.

    Fixed in 1.18.0-6ubuntu14.16
  20. Upgrade

    Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.

    Fixed in 1.18.0-6ubuntu14.16

Event History

Jun 22, 2026
Advisory Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Which deployments have the clearest exposure to the large-header issue?

The large-header issue affects nginx when it is proxying HTTP/2 traffic. Exploitation can be attempted remotely, so internet-reachable nginx proxy deployments handling HTTP/2 are the clearest exposure.

2

Does Ubuntu's default build configuration prevent impact from CVE-2026-42055?

No. The default compiler options for affected releases are expected to reduce the potential impact from arbitrary code execution to denial of service, but nginx may still be crashed.

3

What impact should be considered for the character set conversion issue?

Under certain circumstances, a remote attacker may be able to obtain sensitive information or crash nginx, causing denial of service. The provided information does not identify the specific configuration conditions that trigger it.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203