Ubuntu extends nginx security fixes to older LTS releases, covering six CVEs
- Severity
- High
- Sources
- 1
What happened
USN-8955-2 backports nginx fixes to Ubuntu 20.04, 18.04, 16.04 and 14.04 LTS and adds CVE-2026-42533 (map regex and capture variables, possible DoS or code execution). Other CVEs in the notice are CVE-2026-15176 (alias with rewrite), CVE-2026-93479 (map regex), CVE-2026-97205 (async file I/O with SSI), CVE-2026-95101 (HTTP/3 request data injection with proxyrequestbuffering, 26.04 and 26.10 only) and CVE-2026-97629 (SSL session ticket forgery bypassing client certificate verification with a shared session cache and no ticket key rotation, 24.04, 26.04 and 26.10). Defenders should apply the nginx package updates for their release and review configurations using these directives.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update nginx to the fixed package for your Ubuntu release using the USN-8955-2 notice.
- Prioritise CVE-2026-97629 if you use a shared SSL session cache without explicit ticket key rotation and rely on client certificate verification.
Written by AI from the sources, checked against them
Full story timeline · 1 update
- Thu 5 NovemberUSN-8955-2: nginx vulnerabilitiesUbuntu Security Notices