Back Linuxsecurity

Ubuntu 25.10 nginx Critical Insertion Security Flaw USN-8038

Linuxsecurity •LinuxSecurity Advisories • February 12, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: nginx could be made to insert content into proxied server data. Software Description: - nginx: small, powerful, scalable web/proxy server Details: It was discovered that nginx incorrectly handled proxying to upstream TLS servers. An attacker could possibly use this issue to insert plain text data into the response from an upstream proxied server.

The problem can be corrected by updating your system to the following package versions: Ubuntu 25.10 nginx 1.28.0-6ubuntu1.1 nginx-core 1.28.0-6ubuntu1.1 nginx-extras 1.28.0-6ubuntu1.1 nginx-full 1.28.0-6ubuntu1.1 nginx-light 1.28.0-6ubuntu1.1 Ubuntu 24.04 LTS nginx 1.24.0-2ubuntu7.6 nginx-core 1.24.0-2ubuntu7.6 nginx-extras 1.24.0-2ubuntu7.6 nginx-full 1.24.0-2ubuntu7.6 nginx-light 1.24.0-2ubuntu7.6 Ubuntu 22.04 LTS nginx 1.18.0-6ubuntu14.8 nginx-core 1.18.0-6ubuntu14.8 nginx-extras 1.18.0-6ubuntu14.8 nginx-full 1.18.0-6ubuntu14.8 nginx-light 1.18.0-6ubuntu14.8 In general, a standard system update will make all the necessary changes.

CVE-2026-1642

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical nginx Vulnerability in Ubuntu Affects Multiple Releases A critical security flaw has been identified in nginx affecting Ubuntu 25.10, 24.04 LTS, and 22.04 LTS. The vulnerability allows an attacker to insert plain text data into responses from upstream proxied servers due to improper handling of proxying to upstream TLS servers. Users are advised to apply patches to mitigate the risk. 2 sources 56

Extracted Entities

Ubuntu 25.10 nginx Critical Insertion Security Flaw USN-8038

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Tools (1)