Ubuntu releases security updates for nginx to address multiple CVEs

Ubuntu has issued security notice USN-8955-2 to address several critical vulnerabilities in the nginx web server. These flaws impact a wide range of Ubuntu distributions, including recent releases like 26.10 and 26.04 LTS, as well as legacy versions dating back to 14.04 LTS.

The vulnerabilities include issues with regex matching in map directives, improper handling of HTTP/3 requests, and flaws in SSL session ticket key management. Depending on the specific configuration, these bugs could allow remote attackers to cause service crashes, inject data into proxied requests, or bypass client certificate verification.

Vulnerability breakdown and affected configurations

• Regex and Map Directives: CVE-2026-42533 and CVE-2026-93479 involve incorrect handling of map directives using regex matching and capture variables, which can lead to denial of service or arbitrary code execution.
• HTTP/3 and Proxy Buffering: CVE-2026-95101 affects Ubuntu 26.04 LTS and 26.10, where improper handling of HTTP/3 requests with proxy_request_buffering enabled allows for data injection into proxied requests.
• SSL Session Security: CVE-2026-97629 impacts Ubuntu 24.04 LTS, 26.04 LTS, and 26.10, where a lack of explicit ticket key rotation in shared session caches allows for forged client SSL sessions and certificate verification bypass.
• File I/O and Rewrite Rules: CVE-2026-97205 involves asynchronous file I/O errors with Server Side Includes, while CVE-2026-15176 concerns the alias directive used alongside rewrite rules, both potentially leading to crashes or code execution.
• Legacy Support: Fixes for older versions (14.04 through 20.04 LTS) are provided specifically through Ubuntu Pro and the Legacy Support add-on.

Why it matters

System administrators running nginx as a reverse proxy or web server must prioritize these updates, especially those utilizing HTTP/3 or complex regex-based routing. The breadth of affected versions highlights the ongoing necessity of extended security maintenance for long-term server deployments.