USN-8398-2
nginx regression
USN-8398-2 is a vulnerability with no CVSS score yet in nginx, published June 9, 2026. No source lists public exploit code. Fixed in nginx 1.18.0-6ubuntu14.14.
USN-8398-1 fixed a vulnerability in nginx. The update introduced a regression causing nginx to crash when being used with external modules. This update reverts the fix for CVE-2026-49975 pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nginx to consume excessive resources, resulting in a denial of service.
What each source reports
OSV No score
nginx regression
USN-8398-1 fixed a vulnerability in nginx. The update introduced a regression causing nginx to crash when being used with external modules. This update reverts the fix for CVE-2026-49975 pending further investigation.
We apologize for the inconvenience.
Original advisory details:
It was discovered that nginx incorrectly handled certain cookie headers in the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nginx to consume excessive resources, resulting in a denial of service.
- Record
USN-8398-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nginxUbuntu:22.04:LTS |
before 1.18.0-6ubuntu14.14, plus listed versions 1.18.0-6ubuntu111.18.0-6ubuntu121.18.0-6ubuntu141.18.0-6ubuntu14.11.18.0-6ubuntu14.2 Show 10 moreShow less1.18.0-6ubuntu14.31.18.0-6ubuntu14.41.18.0-6ubuntu14.51.18.0-6ubuntu14.61.18.0-6ubuntu14.71.18.0-6ubuntu14.81.18.0-6ubuntu14.101.18.0-6ubuntu14.111.18.0-6ubuntu14.121.18.0-6ubuntu14.13 |
1.18.0-6ubuntu14.14 |
nginxUbuntu:24.04:LTS |
before 1.24.0-2ubuntu7.11, plus listed versions 1.24.0-1ubuntu11.24.0-2ubuntu11.24.0-2ubuntu21.24.0-2ubuntu31.24.0-2ubuntu4 Show 11 moreShow less1.24.0-2ubuntu61.24.0-2ubuntu71.24.0-2ubuntu7.11.24.0-2ubuntu7.31.24.0-2ubuntu7.41.24.0-2ubuntu7.51.24.0-2ubuntu7.61.24.0-2ubuntu7.71.24.0-2ubuntu7.81.24.0-2ubuntu7.91.24.0-2ubuntu7.10 |
1.24.0-2ubuntu7.11 |
nginxUbuntu:25.10 |
before 1.28.0-6ubuntu1.6, plus listed versions 1.26.3-2ubuntu11.26.3-3ubuntu11.26.3-3ubuntu21.26.3-3ubuntu31.28.0-3ubuntu1 Show 7 moreShow less1.28.0-4ubuntu11.28.0-6ubuntu11.28.0-6ubuntu1.11.28.0-6ubuntu1.21.28.0-6ubuntu1.31.28.0-6ubuntu1.41.28.0-6ubuntu1.5 |
1.28.0-6ubuntu1.6 |
nginxUbuntu:26.04:LTS |
before 1.28.3-2ubuntu1.4, plus listed versions 1.28.0-6ubuntu11.28.1-2ubuntu11.28.1-3ubuntu11.28.2-2ubuntu11.28.3-2ubuntu11.28.3-2ubuntu1.11.28.3-2ubuntu1.21.28.3-2ubuntu1.3 |
1.28.3-2ubuntu1.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | OSV |