Security News

Cybersecurity news aggregator

🔓
HIGH Vulnerabilities Ubuntu Security

USN-8563-2: nginx regression

A regression in USN-8563-1 caused ABI issues for nginx external modules, prompting a reversion of the fix for CVE-2026-42533 (CVSS 8.1 HIGH), a regex handling flaw in map directives allowing remote DoS or code execution. Two other vulnerabilities are detailed: a use-after-free in ngx_http_ssi_module (CVE-2026-56434, CVSS 6.5 MEDIUM) and an information leak/crash in ngx_http_slice_module (CVE-2026-60005, CVSS 8.2 HIGH). The article does not provide specific affected or fixed version numbers from the NVD data.
Read Full Article →

USN-8563-1 fixed vulnerabilities in nginx. One of the fixes introduced ABI changes that could cause issues with external modules. This update reverts the fix for CVE-2026-42533 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could use this issue to cause nginx to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-42533) It was discovered that nginx had a use-after-free vulnerability in the ngx_http_ssi_module module when configured with Server-Side Includes, proxy_pass, and proxy buffering disabled directives. An attacker able to intercept traffic and control responses from an upstream server could possibly use this issue to cause nginx to crash, resulting in a denial of service. (CVE-2026-56434) It was discovered that nginx incorrectly handled certain requests in the ngx_http_slice_module module. A remote attacker could possibly use this issue to obtain sensitive information or cause nginx to crash, resulting in a denial of service. (CVE-2026-60005)

Share this article