Ubuntu: nginx flaws may crash the server or allow code execution
Original title: USN-8955-1: nginx vulnerabilities
Two named CVEs cover alias-plus-rewrite and regex map handling; a third HTTP/3 issue is only partly described.
Ubuntu notice USN-8955-1 says nginx mishandled some alias configurations used with rewrite rules (CVE-2026-15176) and some map directives that use regex matching (CVE-2026-93479). In both cases a remote attacker could possibly crash nginx or execute arbitrary code. A further issue with HTTP/3 requests when proxy_request_buffering was enabled is mentioned only for Ubuntu 26.04 LTS; the snippet cuts off before naming that CVE or a fix.
Unconfirmed: The snippet is cut off, so the third issue's CVE, full scope, and any fixes are not stated.
- CVE-2026-15176 involves the alias directive together with rewrite rules.
- CVE-2026-93479 involves map directives that use regex matching.
- The HTTP/3 issue is stated to affect only Ubuntu 26.04 LTS.
- Both named issues may cause a crash or arbitrary code execution.
Impact: Possible nginx crash or arbitrary code execution
| Product | Affected |
|---|---|
| nginx | Ubuntu 26.04 LTS for the HTTP/3 issue; other ranges not stated |
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-15176+1 related CVE | NGINX heap overflow via alias and $request_filename | 9.2 | <1% | PoC |
From the original article
It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.