USN-8398-2

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-8398-2

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8398-2.json

JSON Data

https://api.osv.dev/v1/vulns/USN-8398-2

Related

UBUNTU-CVE-2026-49975

Published

2026-06-09T13:48:05Z

Modified

2026-06-09T21:15:20.239079527Z

Summary

nginx regression

Details

USN-8398-1 fixed a vulnerability in nginx. The update introduced a regression causing nginx to crash when being used with external modules. This update reverts the fix for CVE-2026-49975 pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nginx to consume excessive resources, resulting in a denial of service.

References

Affected packages

Ubuntu:22.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.18.0-6ubuntu14.14

Affected versions

1.*

1.18.0-6ubuntu11

1.18.0-6ubuntu12

1.18.0-6ubuntu14

1.18.0-6ubuntu14.1

1.18.0-6ubuntu14.2

1.18.0-6ubuntu14.3

1.18.0-6ubuntu14.4

1.18.0-6ubuntu14.5

1.18.0-6ubuntu14.6

1.18.0-6ubuntu14.7

1.18.0-6ubuntu14.8

1.18.0-6ubuntu14.10

1.18.0-6ubuntu14.11

1.18.0-6ubuntu14.12

1.18.0-6ubuntu14.13

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-auth-pam",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-cache-purge",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-dav-ext",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-echo",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-fancyindex",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-geoip2",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-headers-more-filter",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-ndk",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-subs-filter",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-uploadprogress",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-upstream-fair",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-nchan",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-rtmp",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip2",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.18.0-6ubuntu14.14"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.18.0-6ubuntu14.14"
        }
    ]
}

Database specific

cves_map

{
    "ecosystem": "Ubuntu:22.04:LTS",
    "cves": []
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8398-2.json"

Ubuntu:24.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.24.0-2ubuntu7.11

Affected versions

1.*

1.24.0-1ubuntu1

1.24.0-2ubuntu1

1.24.0-2ubuntu2

1.24.0-2ubuntu3

1.24.0-2ubuntu4

1.24.0-2ubuntu6

1.24.0-2ubuntu7

1.24.0-2ubuntu7.1

1.24.0-2ubuntu7.3

1.24.0-2ubuntu7.4

1.24.0-2ubuntu7.5

1.24.0-2ubuntu7.6

1.24.0-2ubuntu7.7

1.24.0-2ubuntu7.8

1.24.0-2ubuntu7.9

1.24.0-2ubuntu7.10

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.24.0-2ubuntu7.11"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.24.0-2ubuntu7.11"
        }
    ]
}

Database specific

cves_map

{
    "ecosystem": "Ubuntu:24.04:LTS",
    "cves": []
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8398-2.json"

Ubuntu:25.10 / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.28.0-6ubuntu1.6

Affected versions

1.*

1.26.3-2ubuntu1

1.26.3-3ubuntu1

1.26.3-3ubuntu2

1.26.3-3ubuntu3

1.28.0-3ubuntu1

1.28.0-4ubuntu1

1.28.0-6ubuntu1

1.28.0-6ubuntu1.1

1.28.0-6ubuntu1.2

1.28.0-6ubuntu1.3

1.28.0-6ubuntu1.4

1.28.0-6ubuntu1.5

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.28.0-6ubuntu1.6"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.28.0-6ubuntu1.6"
        }
    ]
}

Database specific

cves_map

{
    "ecosystem": "Ubuntu:25.10",
    "cves": []
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8398-2.json"

Ubuntu:26.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.28.3-2ubuntu1.4

Affected versions

1.*

1.28.0-6ubuntu1

1.28.1-2ubuntu1

1.28.1-3ubuntu1

1.28.2-2ubuntu1

1.28.3-2ubuntu1

1.28.3-2ubuntu1.1

1.28.3-2ubuntu1.2

1.28.3-2ubuntu1.3

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.28.3-2ubuntu1.4"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.28.3-2ubuntu1.4"
        }
    ]
}

Database specific

cves_map

{
    "ecosystem": "Ubuntu:26.04:LTS",
    "cves": []
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8398-2.json"