WhatBrokeToday
Today's Trends
minorInvestigatingUbuntuvUbuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS

nginx CVE-2026-42533 - Remote Crash Vulnerability

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

A remote attacker could use a vulnerability in nginx to crash the server. This update fixes the issue for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

nginx incorrectly handled certain map directives using regex matching and capture variables

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    USN-8955-2: nginx vulnerabilities(opens security advisory in a new tab)

    USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides the corresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 14.04 LTS. In addition, this update fixes CVE-2026-42533 for these releases. It was discovered that nginx incorrectly handled certain map directives using regex matching and capture variables. A remote attacker could possibly use this issue to crash nginx, resulting…

    by Ubuntu Security 0upvotes 0comments

Timeline

  1. First report on security advisory

    USN-8955-2: nginx vulnerabilities

    Source