UbuntuUpdates.org

Package "nginx-extras"

Name: nginx-extras

Description:

nginx web/proxy server (extended version)
Latest version: 1.28.3-2ubuntu1.12
Release: resolute (26.04)
Level: updates
Repository: universe
Head package: nginx
Homepage: https://nginx.org

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "nginx-extras"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "nginx-extras" in Resolute

Repository Area Version
base universe 1.28.3-2ubuntu1
security universe 1.28.3-2ubuntu1.12

Changelog

Version: 1.28.3-2ubuntu1.12 2026-10-26 19:07:49 UTC

nginx (1.28.3-2ubuntu1.12) resolute-security; urgency=medium

  * SECURITY UPDATE: heap overflow in certain configurations
    - debian/patches/CVE-2026-15176.patch: Avoid post-rewrite URI to path
      mapping with alias in src/http/ngx_http_core_module.c.
    - CVE-2026-15176
  * SECURITY UPDATE: heap overflow in certain configurations
    - debian/patches/CVE-2026-93479.patch: Script: reserved memory overrun
      protection in ngx_http_script_run() in src/http/ngx_http_script.c,
      src/stream/ngx_stream_script.c.
    - CVE-2026-93479
  * SECURITY UPDATE: data injection via HTTP/3 with proxy_request_buffering
    - debian/patches/CVE-2026-95101.patch: HTTP/3: kept the skipped frame length
      separate from data length in src/http/v3/ngx_http_v3_parse.c.
    - CVE-2026-95101
  * SECURITY UPDATE: UaF when asynchronous file I/O is enabled
    - debian/patches/CVE-2026-97205.patch: Limited the number of pending
      operations per request in src/http/ngx_http_copy_filter_module.c,
      src/http/ngx_http_file_cache.c, src/http/ngx_http_upstream.c.
    - CVE-2026-97205
  * SECURITY UPDATE: client SSL session forgery
    - debian/patches/CVE-2026-97629.patch: SSL: synced all session ticket keys
      to the worker process in src/event/ngx_event_openssl.c.
    - CVE-2026-97629

 -- Marc Deslauriers Sat, 24 Oct 2026 10:23:21 -0400
Source diff to previous version
CVE-2026-15176 A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a se
CVE-2026-93479 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format refer
CVE-2026-95101 Description NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with proxy_request_buffering
CVE-2026-97205 NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain conf
CVE-2026-97629 Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key

Version: 1.28.3-2ubuntu1.11 2026-09-14 16:07:43 UTC

nginx (1.28.3-2ubuntu1.11) resolute-security; urgency=medium

  * SECURITY UPDATE: DoS and possible code execution via map directive
    - debian/patches/CVE-2026-42533.patch: fix DoS and possible code execution
      via map directive in src/http/modules/ngx_http_fastcgi_module.c,
      src/http/modules/ngx_http_grpc_module.c,
      src/http/modules/ngx_http_index_module.c,
      src/http/modules/ngx_http_proxy_module.c,
      src/http/modules/ngx_http_rewrite_module.c,
      src/http/modules/ngx_http_scgi_module.c,
      src/http/modules/ngx_http_try_files_module.c,
      src/http/modules/ngx_http_uwsgi_module.c, src/http/ngx_http_script.c,
      src/http/ngx_http_script.h, src/stream/ngx_stream_script.c,
      src/stream/ngx_stream_script.h.
    - CVE-2026-42533

 -- Marc Deslauriers Sun, 06 Sep 2026 18:21:32 -0400
Source diff to previous version
CVE-2026-42533 A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's rege

Version: 1.28.3-2ubuntu1.10 2026-08-19 23:06:55 UTC
No changelog available yet.
Source diff to previous version

Version: 1.28.3-2ubuntu1.9 2026-08-19 16:08:48 UTC
No changelog available yet.
Source diff to previous version

Version: 1.28.3-2ubuntu1.8 2026-07-21 19:09:05 UTC
No changelog available yet.


About   -   Send Feedback to @ubuntu_updates