Cyber ·
USN-8955-1: five nginx vulnerabilities fixed by Ubuntu
Ubuntu Security advisory, published October 26, 2026, on five nginx vulnerabilities that can cause denial of service, code execution, data injection and SSL session forgery.
Advisory USN-8955-1, published by Ubuntu Security on October 26, 2026, reports that Ubuntu fixed five vulnerabilities in nginx. According to the text, the risks include denial of service, code execution, data injection and SSL session forgery. The first case (CVE-2026-15176) involves configurations that use the alias directive together with rewrite rules. The second (CVE-2026-93479) involves map directives that use regex matching under certain circumstances. The third (CVE-2026-95101) affects HTTP/3 requests when proxy_request_buffering is enabled; according to the advisory, it applies only to Ubuntu 26.04 LTS and Ubuntu 26.10. The fourth (CVE-2026-97205) concerns asynchronous file I/O in configurations with Server Side Includes pages. The fifth (CVE-2026-97629) involves SSL session ticket keys when a shared session cache is used without explicit key rotation; according to the advisory, it affects Ubuntu 24.04 LTS, Ubuntu 26.04 LTS and Ubuntu 26.10. In every case, the text says a remote attacker could possibly exploit the flaw. The original content is an automatic translation of the Ubuntu security feed. To verify, consult the official advisory USN-8955-1 on the Ubuntu site and compare the nginx package version installed on each server with the version stated in the fix.