CVE-2026-42533, CVE-2026-56434, and CVE-2026-60005

A corrected fix is required for CVE-2026-42533.

Ubuntu’s first package update shipped on 20 July 2026. That CVE-2026-42533 fix was later backed out because it could cause a regression. The corrected packages published on 19 August 2026 contain the improved fix.

This nginx update is not one uniform vulnerability. Each flaw depends on a different configuration path, and the most severe score does not automatically describe every nginx deployment. The useful question is whether the relevant directive and traffic conditions exist in your environment.

At a glance

CVE	Primary effect	CVSS v4.0	CVSS v3.1
CVE-2026-42533	Heap overflow, worker restart, possible code execution	9.2 CriticalCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-56434	Use after free, limited memory modification, worker restart	8.3 HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N	6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVE-2026-60005	Limited memory disclosure or worker restart	8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N	8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

The table uses Ubuntu’s published base scores and vectors. Ubuntu assigns Medium priority to all three in its distribution context, illustrating why a vendor priority and a raw CVSS base score should not be treated as the same signal.

The patch story matters

USN-8563-1 originally fixed all three issues. The CVE-2026-42533 change was then backed out in USN-8563-2 after a regression was identified. USN-8563-3 restored protection with a better fix.

This is why checking only whether an update was installed in July is insufficient. The installed package version needs to meet the August revision shown below.

CVE-2026-42533

Map capture variables and a heap overflow

The vulnerable path involves a map directive using regular-expression matching while another string expression references the map capture variables before the map output variable. Certain uses of non-cacheable variables can reach a similar condition.

An unauthenticated client can send crafted HTTP requests that may overflow heap memory in an nginx worker. A worker restart is the direct availability impact. Code execution is described as possible when address-space randomization is disabled or can be bypassed.

Operator take: This is the issue to prioritize first. Search configuration templates and generated configuration for map directives, regex captures, and capture-variable reuse. High attack complexity lowers exploit reliability, but it does not make an internet-facing affected configuration acceptable.

CVE-2026-56434

SSI proxying and a use after free

This flaw depends on a specific combination: Server-Side Includes, proxying, and disabled proxy buffering. Exploitation also requires an attacker capable of intercepting traffic and controlling responses from an upstream server.

The resulting use after free can cause limited memory modification or restart the nginx worker. The required upstream-response position explains the lower CVSS v3.1 score and the attack-requirements distinction in CVSS v4.0.

Operator take: Confirm whether SSI is actually enabled and whether unbuffered upstream responses cross a network boundary you do not fully control. The condition is narrower than a generic remote nginx flaw, but it matters in proxy-heavy deployments.

CVE-2026-60005

HTTP slicing and uninitialized memory

The HTTP slice module can access uninitialized memory when the slice directive interacts with unnamed regex captures or when a background cache update occurs. An unauthenticated request may then expose limited worker memory or cause a restart.

The slice module is not enabled in a default upstream nginx build, but distribution packages and custom builds may include it. Presence of the module alone is not the complete condition. The relevant slicing and caching configuration still matters.

Operator take: Check both build capabilities and active configuration. Pay particular attention to caches using background refresh and deployments that split large responses into byte ranges.

What to check

Start with the running binary and installed package, then inspect the effective configuration. The configuration dump may contain secrets, so review it locally and do not paste it into an untrusted service.

nginx -V
apt-cache policy nginx
sudo nginx -T

Look for map directives that use regex captures and variables derived from those captures.
Check whether SSI, upstream proxying, and disabled proxy buffering appear together.
Check whether HTTP slicing, unnamed captures, or background cache updates are in use.
Remember that container images and custom nginx builds may not follow the host Ubuntu package lifecycle.

Ubuntu package status

As one distribution-specific patch reference, Ubuntu lists these minimum source-package versions for the corrected nginx package family:

Ubuntu release	Fixed version
Ubuntu 26.04 LTS	1.28.3-2ubuntu1.9
Ubuntu 24.04 LTS	1.24.0-2ubuntu7.16
Ubuntu 22.04 LTS	1.18.0-6ubuntu14.19

The listed revision applies across the corresponding nginx, nginx-core, nginx-extras, nginx-full, and nginx-light packages. A standard Ubuntu security update installs the fixes. If nginx comes from a container, third-party repository, or local build, use that supplier’s fixed version instead.