← All notices | Source (USN-8955-1) | Text version

QSN-8955-1: nginx vulnerabilities

October 26, 2026

Summary

Several security issues were fixed in nginx.

Details

It was discovered that nginx incorrectly handled certain configurations using the alias directive together with rewrite rules. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-15176)

It was discovered that nginx incorrectly handled map directives using regex matching under certain circumstances. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-93479)

It was discovered that nginx incorrectly handled HTTP/3 requests when proxy_request_buffering was enabled. This issue only affected Ubuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use this issue to inject data into proxied requests. (CVE-2026-95101)

It was discovered that nginx incorrectly handled asynchronous file I/O in certain configurations with Server Side Includes pages. A remote attacker could possibly use this issue to cause nginx to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-97205)

It was discovered that nginx incorrectly handled SSL session ticket keys when configured with a shared session cache but without explicit ticket key rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS, and Ubuntu 26.10. A remote attacker could possibly use this issue to forge client SSL sessions and bypass client certificate verification. (CVE-2026-97629)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.221.18.0-6ubuntu14.22Fixed in this release
6.9.1.001Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.221.18.0-6ubuntu14.22Fixed in this release
6.9.1.001Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.221.18.0-6ubuntu14.22Fixed in this release
6.9.1.001Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.221.18.0-6ubuntu14.22Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.211.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.9.0.464Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.211.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.9.0.464Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.211.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.9.0.464Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.211.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.201.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.201.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.201.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.6.015Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.201.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.181.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibnginx-mod-http-echoExternally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibnginx-mod-http-geoip2Externally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSnginx-commonInternally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSnginx-lightExternally-facing1.18.0-6ubuntu14.161.18.0-6ubuntu14.22Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-97205, CVE-2026-97629, CVE-2026-15176, CVE-2026-93479, CVE-2026-95101

References

https://ubuntu.com/security/notices/USN-8955-1

https://nvd.nist.gov/vuln/detail/CVE-2026-97205

https://nvd.nist.gov/vuln/detail/CVE-2026-97629

https://nvd.nist.gov/vuln/detail/CVE-2026-15176

https://nvd.nist.gov/vuln/detail/CVE-2026-93479

https://nvd.nist.gov/vuln/detail/CVE-2026-95101

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
Ubuntu 22.04 LTSnginx1.18.0-6ubuntu14.22
Ubuntu 24.04 LTSnginx1.24.0-2ubuntu7.19
resolutenginx1.28.3-2ubuntu1.12
stonkingnginx1.30.4-7ubuntu1.1