Ubuntu patches five nginx vulnerabilities across 22.04 LTS through 26.10

Canonical has issued USN-8955-1 to address five security vulnerabilities in nginx affecting Ubuntu 22.04 LTS, 24.04 LTS, 26.04 LTS, and 26.10. The flaws span multiple subsystems: alias directive handling with rewrite rules, regex-based map directives, HTTP/3 request processing, asynchronous file I/O with Server Side Includes, and SSL session ticket key management. Several bugs permit remote attackers to crash nginx or potentially execute arbitrary code, while one allows data injection into proxied HTTP/3 requests and another enables SSL session forgery that bypasses client certificate verification.

The HTTP/3 proxy request injection (CVE-2026-95101) is limited to Ubuntu 26.04 LTS and 26.10, while the SSL session ticket key flaw (CVE-2026-97629) affects only 24.04 LTS, 26.04 LTS, and 26.10. Patched package versions are now available: nginx 1.30.4-7ubuntu1.1 for 26.10, 1.28.3-2ubuntu1.12 for 26.04 LTS, 1.24.0-2ubuntu7.19 for 24.04 LTS, and 1.18.0-6ubuntu14.22 for 22.04 LTS, with corresponding updates for nginx-core, nginx-extras, nginx-full, and nginx-light variants.

Vulnerability breakdown and affected configurations

• Alias directive with rewrite rules (CVE-2026-15176): nginx mishandled certain configurations combining the alias directive with rewrite rules, exposing a path for remote attackers to trigger denial of service or arbitrary code execution.
• Map directive regex matching (CVE-2026-93479): Incorrect handling of map directives using regex matching under specific conditions allowed remote attackers to crash nginx or potentially execute arbitrary code.
• HTTP/3 proxy request buffering (CVE-2026-95101): When proxy_request_buffering was enabled, nginx improperly handled HTTP/3 requests, permitting remote data injection into proxied requests; this affected only Ubuntu 26.04 LTS and 26.10.
• Asynchronous file I/O with SSI (CVE-2026-97205): Certain configurations using Server Side Includes with asynchronous file I/O were handled incorrectly, creating a remote vector for crashes or arbitrary code execution.
• SSL session ticket key rotation (CVE-2026-97629): nginx failed to properly manage SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation, allowing remote attackers to forge client SSL sessions and bypass client certificate verification; affected Ubuntu 24.04 LTS, 26.04 LTS, and 26.10.

Why it matters

nginx serves as a foundational component of Linux web infrastructure, powering reverse proxies, load balancers, and static content delivery for countless services and cloud deployments. These patches are critical for system administrators running Ubuntu-based servers, particularly those using SSL client certificate authentication or HTTP/3 proxying, where the most severe flaws enable authentication bypass and request manipulation. The broad release coverage ensures long-term support deployments remain protected, reinforcing Ubuntu's maintenance commitment for infrastructure software.