Back Linuxsecurity

Ubuntu 26.04 LTS Nginx Critical Denial Of Service Regression Vuln 8398

Linuxsecurity •LinuxSecurity Advisories • June 9, 2026

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 26.04 LTS - Ubuntu 25.10 - Ubuntu 24.04 LTS - Ubuntu 22.04 LTS Summary: USN-8398-1 introduced a regression in nginx Software Description: - nginx: small, powerful, scalable web/proxy server Details: USN-8398-1 fixed a vulnerability in nginx. The update introduced a regression causing nginx to crash when being used with external modules. This update reverts the fix for CVE-2026-49975 pending further investigation. We apologize for the inconvenience. Original advisory details: It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nginx to consume excessive resources, resulting in a denial of service.

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS nginx 1.28.3-2ubuntu1.4 nginx-core 1.28.3-2ubuntu1.4 nginx-extras 1.28.3-2ubuntu1.4 nginx-full 1.28.3-2ubuntu1.4 nginx-light 1.28.3-2ubuntu1.4 Ubuntu 25.10 nginx 1.28.0-6ubuntu1.6 nginx-core 1.28.0-6ubuntu1.6 nginx-extras 1.28.0-6ubuntu1.6 nginx-full 1.28.0-6ubuntu1.6 nginx-light 1.28.0-6ubuntu1.6 Ubuntu 24.04 LTS nginx 1.24.0-2ubuntu7.11 nginx-core 1.24.0-2ubuntu7.11 nginx-extras 1.24.0-2ubuntu7.11 nginx-full 1.24.0-2ubuntu7.11 nginx-light 1.24.0-2ubuntu7.11 Ubuntu 22.04 LTS nginx 1.18.0-6ubuntu14.14 nginx-core 1.18.0-6ubuntu14.14 nginx-extras 1.18.0-6ubuntu14.14 nginx-full 1.18.0-6ubuntu14.14 nginx-light 1.18.0-6ubuntu14.14 In general, a standard system update will make all the necessary changes.

Ubuntu Security Notice USN-8398-2

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nginx Denial of Service Vulnerability and Regression Issues A vulnerability in nginx was discovered that allows remote attackers to cause excessive resource consumption through specially crafted HTTP/2 cookie headers, leading to denial of service (CVE-2026-49975). The initial fix for this vulnerability introduced a regression causing nginx to crash when used with external modules. This regression has prompted a reversion of the fix pending further investigation. Affected systems include multiple Ubuntu LTS versions, specifically 26.04, 25.10, 24.04, and 22.04. Users are advised to update their systems to mitigate the risk. The vulnerability was published on June 8, 2026, with a proof of concept available since June 4, 2026. The situation is ongoing, with further updates expected. 11 sources 71

Extracted Entities

Ubuntu 26.04 LTS Nginx Critical Denial Of Service Regression Vuln 8398

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

Tools (1)