Ubuntu extends nginx security fixes to older LTS releases (USN-8955-2)
Original title: USN-8955-2: nginx vulnerabilities
The notice also fixes CVE-2026-42533, which can let a remote attacker crash nginx or possibly run code.
USN-8955-2 backports nginx fixes from USN-8955-1 to Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS, and 14.04 LTS. The earlier notice covered Ubuntu 26.10, 26.04 LTS, 24.04 LTS, and 22.04 LTS. This update also fixes CVE-2026-42533, where nginx mishandles certain map directives that use regex matching and capture variables. A remote attacker could crash nginx or possibly execute arbitrary code. The feed cuts off the original advisory details.
Unconfirmed: The snippet cuts off the original issues and does not name other CVEs, fixed package versions, or exploitation status.
- USN-8955-1 already fixed nginx on Ubuntu 22.04 LTS through 26.10.
- CVE-2026-42533 is additionally fixed on Ubuntu 14.04 through 20.04 LTS.
- The issue involves map directives using regex matching and capture variables.
- Fixed package versions are not stated in the feed snippet.
Impact: remote denial of service or possible code execution
| Product | Affected |
|---|---|
| Ubuntu nginx | Ubuntu 20.04 LTS, 18.04 LTS, 16.04 LTS, and 14.04 LTS |
- 1.Install the USN-8955-2 nginx updates on Ubuntu 20.04, 18.04, 16.04, and 14.04 LTS.
- CVEs
- CVE-2026-42533
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-42533 | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture… | 9.2 | 6% | PoC ×2 |
From the original article
USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26. 10, Ubuntu 26. 04 LTS, Ubuntu 24.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.