UbuntuUpdates.org

Package "nginx-core"

Name: nginx-core

Description:

nginx web/proxy server (standard version)
Latest version: 1.24.0-2ubuntu7.19
Release: noble (24.04)
Level: security
Repository: main
Head package: nginx
Homepage: https://nginx.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx-core"

All arch deb package
APT INSTALL

Other versions of "nginx-core" in Noble

Repository Area Version
base main 1.24.0-2ubuntu7
updates main 1.24.0-2ubuntu7.19

Changelog

Version: 1.24.0-2ubuntu7.19 2026-10-26 18:07:42 UTC

nginx (1.24.0-2ubuntu7.19) noble-security; urgency=medium

  * SECURITY UPDATE: heap overflow in certain configurations
    - debian/patches/CVE-2026-15176.patch: Avoid post-rewrite URI to path
      mapping with alias in src/http/ngx_http_core_module.c.
    - CVE-2026-15176
  * SECURITY UPDATE: heap overflow in certain configurations
    - debian/patches/CVE-2026-93479.patch: Script: reserved memory overrun
      protection in ngx_http_script_run() in src/http/ngx_http_script.c,
      src/stream/ngx_stream_script.c.
    - CVE-2026-93479
  * SECURITY UPDATE: UaF when asynchronous file I/O is enabled
    - debian/patches/CVE-2026-97205.patch: Limited the number of pending
      operations per request in src/http/ngx_http_copy_filter_module.c,
      src/http/ngx_http_file_cache.c, src/http/ngx_http_upstream.c.
    - CVE-2026-97205
  * SECURITY UPDATE: client SSL session forgery
    - debian/patches/CVE-2026-97629.patch: SSL: synced all session ticket keys
      to the worker process in src/event/ngx_event_openssl.c.
    - CVE-2026-97629

 -- Marc Deslauriers Sat, 24 Oct 2026 10:34:33 -0400
Source diff to previous version
CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a se
CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format refer
CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain conf
CVE-2026-97629 Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key

Version: 1.24.0-2ubuntu7.18 2026-09-14 15:07:49 UTC

nginx (1.24.0-2ubuntu7.18) noble-security; urgency=medium

  * SECURITY UPDATE: DoS and possible code execution via map directive
    - debian/patches/CVE-2026-42533.patch: fix DoS and possible code execution
      via map directive in src/http/modules/ngx_http_fastcgi_module.c,
      src/http/modules/ngx_http_grpc_module.c,
      src/http/modules/ngx_http_index_module.c,
      src/http/modules/ngx_http_proxy_module.c,
      src/http/modules/ngx_http_rewrite_module.c,
      src/http/modules/ngx_http_scgi_module.c,
      src/http/modules/ngx_http_try_files_module.c,
      src/http/modules/ngx_http_uwsgi_module.c, src/http/ngx_http_script.c,
      src/http/ngx_http_script.h, src/stream/ngx_stream_script.c,
      src/stream/ngx_stream_script.h.
    - CVE-2026-42533

 -- Marc Deslauriers Sat, 05 Sep 2026 22:01:18 -0400
Source diff to previous version
CVE-2026-42533 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's rege

Version: 1.24.0-2ubuntu7.17 2026-08-19 22:07:49 UTC
No changelog available yet.
Source diff to previous version

Version: 1.24.0-2ubuntu7.16 2026-08-19 15:08:25 UTC
No changelog available yet.
Source diff to previous version

Version: 1.24.0-2ubuntu7.15 2026-07-20 23:08:42 UTC
No changelog available yet.


About   -   Send Feedback to @ubuntu_updates