Canonical Ubuntu Linux: out-of-bounds read

At a glance

Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…

The flaws

• CVE-2026-64559: Out-of-bounds read (CVSS 7.8 · EPSS 0%)
• CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
• CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
• CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)

The fix

Fix: Check the linked advisory for the concrete fix.

Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}

Where it stands

• No known exploitation

How it unfolded

1. 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
2. 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
3. 6 Nov, Ubuntu security notices (official): USN-9003-1: Linux kernel (NVIDIA) vulnerabilities

Connects to

• Same weakness: Out-of-bounds read (CWE-125). 399 other warnings in 30 days
• Same product: Earlier Canonical Ubuntu Linux warnings. 147 in the last 90 days