Ubuntu extends nginx security fixes to older LTS releases, covering six CVEs
VULNERABILITYNGINXredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Ubuntu's USN-8955-2 extends earlier nginx fixes to 20.04, 18.04, 16.04 and 14.04 LTS and adds a fix for CVE-2026-42533. The flaws include crashes and possible code execution via map directives, alias with rewrite rules and Server Side Includes, plus HTTP/3 data injection on 26.04 and 26.10. Forged SSL sessions that bypass client certificate checks affect 24.04, 26.04 and 26.10 when a shared session cache is used without ticket key rotation.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Update nginx to the fixed package for your Ubuntu release using the USN-8955-2 notice.
- Prioritise CVE-2026-97629 if you use a shared SSL session cache without explicit ticket key rotation and rely on client certificate verification.
Written by AI from the sources, checked against them
Full story timeline · 1 update
- Thu 5 NovemberUSN-8955-2: nginx vulnerabilitiesUbuntu Security Notices
Who reported · 1 outlet
Ubuntu Security Notices