USN-8563-4

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/notices/USN-8563-4

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8563-4.json

JSON Data

https://api.osv.dev/v1/vulns/USN-8563-4

Related

UBUNTU-CVE-2026-42533

Published

2026-08-19T19:30:43Z

Modified

2026-08-20T05:15:04.273973182Z

Summary

nginx regression

Details

USN-8563-3 fixed a vulnerability in nginx. The fix introduced a regression in certain environments. This update reverts the fix for CVE-2026-42533 pending further investigation.

We apologize for the inconvenience.

Original advisory details:

It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533)

It was discovered that nginx had a use-after-free vulnerability in the ngxhttpssimodule module when configured with Server-Side Includes, proxypass, and proxy buffering disabled directives. An attacker able to intercept traffic and control responses from an upstream server could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-56434)

It was discovered that nginx incorrectly handled certain requests in the ngxhttpslice_module module. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-60005)

References

Affected packages

Ubuntu:22.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.18.0-6ubuntu14.20

Affected versions

1.*

1.18.0-6ubuntu11

1.18.0-6ubuntu12

1.18.0-6ubuntu14

1.18.0-6ubuntu14.1

1.18.0-6ubuntu14.2

1.18.0-6ubuntu14.3

1.18.0-6ubuntu14.4

1.18.0-6ubuntu14.5

1.18.0-6ubuntu14.6

1.18.0-6ubuntu14.7

1.18.0-6ubuntu14.8

1.18.0-6ubuntu14.10

1.18.0-6ubuntu14.11

1.18.0-6ubuntu14.12

1.18.0-6ubuntu14.13

1.18.0-6ubuntu14.14

1.18.0-6ubuntu14.15

1.18.0-6ubuntu14.16

1.18.0-6ubuntu14.17

1.18.0-6ubuntu14.18

1.18.0-6ubuntu14.19

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-auth-pam",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-cache-purge",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-dav-ext",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-echo",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-fancyindex",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-geoip2",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-headers-more-filter",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-ndk",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-subs-filter",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-uploadprogress",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-upstream-fair",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-nchan",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-rtmp",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip2",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.18.0-6ubuntu14.20"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.18.0-6ubuntu14.20"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [],
    "ecosystem": "Ubuntu:22.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8563-4.json"

Ubuntu:24.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.24.0-2ubuntu7.17

Affected versions

1.*

1.24.0-1ubuntu1

1.24.0-2ubuntu1

1.24.0-2ubuntu2

1.24.0-2ubuntu3

1.24.0-2ubuntu4

1.24.0-2ubuntu6

1.24.0-2ubuntu7

1.24.0-2ubuntu7.1

1.24.0-2ubuntu7.3

1.24.0-2ubuntu7.4

1.24.0-2ubuntu7.5

1.24.0-2ubuntu7.6

1.24.0-2ubuntu7.7

1.24.0-2ubuntu7.8

1.24.0-2ubuntu7.9

1.24.0-2ubuntu7.10

1.24.0-2ubuntu7.11

1.24.0-2ubuntu7.12

1.24.0-2ubuntu7.13

1.24.0-2ubuntu7.14

1.24.0-2ubuntu7.15

1.24.0-2ubuntu7.16

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.24.0-2ubuntu7.17"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.24.0-2ubuntu7.17"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [],
    "ecosystem": "Ubuntu:24.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8563-4.json"

Ubuntu:26.04:LTS / nginx

Package

Name: nginx
Purl: pkg:deb/ubuntu/nginx?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.28.3-2ubuntu1.10

Affected versions

1.*

1.28.0-6ubuntu1

1.28.1-2ubuntu1

1.28.1-3ubuntu1

1.28.2-2ubuntu1

1.28.3-2ubuntu1

1.28.3-2ubuntu1.1

1.28.3-2ubuntu1.2

1.28.3-2ubuntu1.3

1.28.3-2ubuntu1.4

1.28.3-2ubuntu1.5

1.28.3-2ubuntu1.6

1.28.3-2ubuntu1.7

1.28.3-2ubuntu1.8

1.28.3-2ubuntu1.9

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libnginx-mod-http-geoip",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "libnginx-mod-http-image-filter",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "libnginx-mod-http-perl",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "libnginx-mod-http-xslt-filter",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "libnginx-mod-mail",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "libnginx-mod-stream",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "libnginx-mod-stream-geoip",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "nginx",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "nginx-common",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "nginx-core",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "nginx-extras",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "nginx-full",
            "binary_version": "1.28.3-2ubuntu1.10"
        },
        {
            "binary_name": "nginx-light",
            "binary_version": "1.28.3-2ubuntu1.10"
        }
    ],
    "availability": "No subscription required"
}

Database specific

cves_map

{
    "cves": [],
    "ecosystem": "Ubuntu:26.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8563-4.json"