Ubuntu USN-8354-1: nginx multiple vulnerabilities fix advisory including RCE/DoS CVEs

USN-8354-1: nginx vulnerabilities Vulnerability Overview Multiple security vulnerabilities exist in nginx, including: 1. HTTP/3 QUIC module validation issue: nginx did not properly validate the source address, allowing attackers to bypass authorization checks or rate limiting. 2. Use-after-free vulnerability in the ngx_http_ssl_module module: When client certificate verification and OCSP verification are enabled, attackers can cause nginx to crash or modify memory data. 3. Proxy response handling issue in the ngx_http_charset_module module: Attackers can obtain sensitive information or cause nginx to crash. 4. Source address validation issue in the HTTP/3 QUIC module: Attackers can bypass authorization checks or rate limiting. 5. Use-after-free vulnerability in the ngx_http_ssl_module module: When client certificate verification and OCSP verification are enabled, attackers can cause nginx to crash or modify memory data. 6. Proxy response handling issue in the ngx_http_charset_module module: Attackers can obtain sensitive information or cause nginx to crash. 7. SCGI and uWSGI response handling issues: Attackers can obtain sensitive information or cause nginx to crash. 8. Rewrite rule handling issue in the ngx_http_rewrite_module module: Attackers can cause nginx to crash or execute arbitrary code. Affected Versions Ubuntu 25.04 Ubuntu 25.10 Remediation Update Package Versions Ubuntu 26.04 LTS (resolute) - - 1.28.3-2ubuntu1.2 - - 1.28.3-2ubuntu1.2 - - 1.28.3-2ubuntu1.2 - - 1.28.3-2ubuntu1.2 - - 1.28.3-2ubuntu1.2 - - 1.28.0-6ubuntu1.4 - - 1.28.0-6ubuntu1.4 - - 1.28.0-6ubuntu1.4 - - 1.28.0-6ubuntu1.4 - - 1.28.0-6ubuntu1.4 Ubuntu 25.10 (questing) - - 1.24.0-2ubuntu7.9 - - 1.24.0-2ubuntu7.9 - - 1.24.0-2ubuntu7.9 - - 1.24.0-2ubuntu7.9 - - 1.24.0-2ubuntu7.9 Ubuntu 24.04 LTS (noble) - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 Ubuntu 22.04 LTS (jammy) - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 - - 1.18.0-6ubuntu14.12 References CVE-2026-9256 CVE-2026-4248 CVE-2026-4294 CVE-2026-4293 CVE-2026-4070 CVE-2026-4071 CVE-2026-4046

Goal Reached Thanks to every supporter — we hit 100%!

Ubuntu USN-8354-1: nginx multiple vulnerabilities fix advisory including RCE/DoS CVEs