USN-8955-1: nginx vulnerabilities

Q: Which systems are affected by the HTTP/3 request-handling issue?

This issue only affects Ubuntu 26.04 LTS and Ubuntu 26.10 systems where nginx handles HTTP/3 requests and proxy_request_buffering is enabled. It may allow a remote attacker to inject data into proxied requests.

Q: Which nginx configurations are relevant to the denial-of-service or code-execution issues?

The affected configurations include use of the alias directive together with rewrite rules, map directives using regular-expression matching, and certain Server Side Includes page configurations using asynchronous file I/O. The reported impact for these issues includes a remote attacker potentially crashing nginx or executing arbitrary code.

Q: Does exploiting these issues require local access?

The issues described are remotely exploitable. The advisory does not provide further requirements such as authentication, a specific request path, or user interaction.

Published Oct 26, 2026

Updated

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3 requests when proxyrequestbuffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101) It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205) It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)

Affected Software

41 affected componentsFixes available

Ubuntu nginx

All of the following

ubuntu/nginx<1.30.4-7ubuntu1.1

1.30.4-7ubuntu1.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/nginx-core<1.30.4-7ubuntu1.1

1.30.4-7ubuntu1.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/nginx-extras<1.30.4-7ubuntu1.1

1.30.4-7ubuntu1.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/nginx-full<1.30.4-7ubuntu1.1

1.30.4-7ubuntu1.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/nginx-light<1.30.4-7ubuntu1.1

1.30.4-7ubuntu1.1

Ubuntu Ubuntu=26.10

All of the following

ubuntu/nginx<1.28.3-2ubuntu1.12

1.28.3-2ubuntu1.12

Ubuntu Ubuntu=26.04

All of the following

ubuntu/nginx-core<1.28.3-2ubuntu1.12

1.28.3-2ubuntu1.12

Ubuntu Ubuntu=26.04

All of the following

ubuntu/nginx-extras<1.28.3-2ubuntu1.12

1.28.3-2ubuntu1.12

Ubuntu Ubuntu=26.04

All of the following

ubuntu/nginx-full<1.28.3-2ubuntu1.12

1.28.3-2ubuntu1.12

Ubuntu Ubuntu=26.04

All of the following

ubuntu/nginx-light<1.28.3-2ubuntu1.12

1.28.3-2ubuntu1.12

Ubuntu Ubuntu=26.04

All of the following

ubuntu/nginx<1.24.0-2ubuntu7.19

1.24.0-2ubuntu7.19

Ubuntu Ubuntu=24.04

All of the following

ubuntu/nginx-core<1.24.0-2ubuntu7.19

1.24.0-2ubuntu7.19

Ubuntu Ubuntu=24.04

All of the following

ubuntu/nginx-extras<1.24.0-2ubuntu7.19

1.24.0-2ubuntu7.19

Ubuntu Ubuntu=24.04

All of the following

ubuntu/nginx-full<1.24.0-2ubuntu7.19

1.24.0-2ubuntu7.19

Ubuntu Ubuntu=24.04

All of the following

ubuntu/nginx-light<1.24.0-2ubuntu7.19

1.24.0-2ubuntu7.19

Ubuntu Ubuntu=24.04

All of the following

ubuntu/nginx<1.18.0-6ubuntu14.22

1.18.0-6ubuntu14.22

Ubuntu Ubuntu=22.04

All of the following

ubuntu/nginx-core<1.18.0-6ubuntu14.22

1.18.0-6ubuntu14.22

Ubuntu Ubuntu=22.04

All of the following

ubuntu/nginx-extras<1.18.0-6ubuntu14.22

1.18.0-6ubuntu14.22

Ubuntu Ubuntu=22.04

All of the following

ubuntu/nginx-full<1.18.0-6ubuntu14.22

1.18.0-6ubuntu14.22

Ubuntu Ubuntu=22.04

All of the following

ubuntu/nginx-light<1.18.0-6ubuntu14.22

1.18.0-6ubuntu14.22

Ubuntu Ubuntu=22.04

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/nginx to a version that resolves this vulnerability.
Fixed in 1.30.4-7ubuntu1.1
Upgrade
Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.
Fixed in 1.30.4-7ubuntu1.1
Upgrade
Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.
Fixed in 1.30.4-7ubuntu1.1
Upgrade
Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.
Fixed in 1.30.4-7ubuntu1.1
Upgrade
Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.
Fixed in 1.30.4-7ubuntu1.1
Upgrade
Upgrade ubuntu/nginx to a version that resolves this vulnerability.
Fixed in 1.28.3-2ubuntu1.12
Upgrade
Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.
Fixed in 1.28.3-2ubuntu1.12
Upgrade
Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.
Fixed in 1.28.3-2ubuntu1.12
Upgrade
Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.
Fixed in 1.28.3-2ubuntu1.12
Upgrade
Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.
Fixed in 1.28.3-2ubuntu1.12
Upgrade
Upgrade ubuntu/nginx to a version that resolves this vulnerability.
Fixed in 1.24.0-2ubuntu7.19
Upgrade
Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.
Fixed in 1.24.0-2ubuntu7.19
Upgrade
Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.
Fixed in 1.24.0-2ubuntu7.19
Upgrade
Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.
Fixed in 1.24.0-2ubuntu7.19
Upgrade
Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.
Fixed in 1.24.0-2ubuntu7.19
Upgrade
Upgrade ubuntu/nginx to a version that resolves this vulnerability.
Fixed in 1.18.0-6ubuntu14.22
Upgrade
Upgrade ubuntu/nginx-core to a version that resolves this vulnerability.
Fixed in 1.18.0-6ubuntu14.22
Upgrade
Upgrade ubuntu/nginx-extras to a version that resolves this vulnerability.
Fixed in 1.18.0-6ubuntu14.22
Upgrade
Upgrade ubuntu/nginx-full to a version that resolves this vulnerability.
Fixed in 1.18.0-6ubuntu14.22
Upgrade
Upgrade ubuntu/nginx-light to a version that resolves this vulnerability.
Fixed in 1.18.0-6ubuntu14.22

Event History

Oct 26, 2026

Advisory Published

via Ubuntu·12:00 AM

Data Sourced

via Ubuntu·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which systems are affected by the HTTP/3 request-handling issue?

This issue only affects Ubuntu 26.04 LTS and Ubuntu 26.10 systems where nginx handles HTTP/3 requests and proxy_request_buffering is enabled. It may allow a remote attacker to inject data into proxied requests.

Which nginx configurations are relevant to the denial-of-service or code-execution issues?

The affected configurations include use of the alias directive together with rewrite rules, map directives using regular-expression matching, and certain Server Side Includes page configurations using asynchronous file I/O. The reported impact for these issues includes a remote attacker potentially crashing nginx or executing arbitrary code.

Does exploiting these issues require local access?

The issues described are remotely exploitable. The advisory does not provide further requirements such as authentication, a specific request path, or user interaction.

USN-8955-1: nginx vulnerabilities

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are affected by the HTTP/3 request-handling issue?

Which nginx configurations are relevant to the denial-of-service or code-execution issues?

Does exploiting these issues require local access?

Company

Resources

Contact

Frequently Asked Questions

Which systems are affected by the HTTP/3 request-handling issue?

Which nginx configurations are relevant to the denial-of-service or code-execution issues?

Does exploiting these issues require local access?