USN-8955-1: Ubuntu patches five nginx flaws, one bypasses client certificates

Ubuntu released security advisory USN-8955-1 on 26 October 2026, addressing five vulnerabilities in nginx across all supported releases: 22.04 LTS, 24.04 LTS, 26.04 LTS and 26.10. For anyone running a web server or reverse proxy in production, patching should be scheduled immediately: three of the five flaws can cause crashes resulting in denial of service, or in the worst case, arbitrary code execution.

The five CVEs

The corrected vulnerabilities are:

• CVE-2026-15176: improper handling of the alias directive together with rewrite rules, risking crash or code execution.
• CVE-2026-93479: improper handling of map directives with regex matching, same risk as the previous one.
• CVE-2026-95101: improper handling of HTTP/3 requests when proxy_request_buffering is enabled; a remote attacker can inject data into proxied requests. Affects only 26.04 LTS and 26.10.
• CVE-2026-97205: improper handling of asynchronous file I/O in configurations with Server Side Includes pages, risking crash or code execution.
• CVE-2026-97629: improper handling of SSL session ticket keys when a shared session cache is configured without explicit key rotation; a remote attacker can forge client SSL sessions and bypass client certificate verification. Affects 24.04 LTS, 26.04 LTS and 26.10.

The last one warrants technical clarification, which is absent from the Ubuntu advisory: the flaw stems from a bug in ticket key rotation where only a subset of memory slots designated for nginx workers are copied, leaving one slot with a predictable value. The official nginx.org advisory places the issue in upstream versions 1.23.2-1.31.6, resolved in 1.31.7 and 1.30.6: useful information for those compiling nginx from source rather than using distro packages. The exposure condition is specific: it only affects those using ssl_session_cache shared relying on automatic key rotation without setting an explicit ssl_session_ticket_key file.

Fixed versions

Release	Codename	Package version
26.10	stonking	1.30.4-7ubuntu1.1
26.04 LTS	resolute	1.28.3-2ubuntu1.12
24.04 LTS	noble	1.24.0-2ubuntu7.19
22.04 LTS	jammy	1.18.0-6ubuntu14.22

The affected packages are nginx, nginx-core, nginx-extras, nginx-full and nginx-light. Running apt update && apt upgrade on machines with nginx installed applies the fix; where Ubuntu Pro repositories are used, coverage extends to other related packages.