USN-8955-1 fixed vulnerabilities in nginx in Ubuntu 26.10, Ubuntu 26.04LTS, Ubuntu 24.04 LTS, and Ubuntu 22.04 LTS. This update provides thecorresponding update for Ubuntu 20.04 LTS, Ubuntu 18.04 LTS, Ubuntu 16.04LTS, and Ubuntu 14.04 LTS.In addition, this update fixes CVE-2026-42533 for these releases.It was discovered that nginx incorrectly handled certain map directivesusing regex matching and capture variables. A remote attacker couldpossibly use this issue to crash nginx, resulting in a denial ofservice, or possibly execute arbitrary code. (CVE-2026-42533)Original advisory details: It was discovered that nginx incorrectly handled certain configurationsusing the alias directive together with rewrite rules. A remote attackercould possibly use this issue to cause nginx to crash, resulting in adenial of service, or execute arbitrary code. (CVE-2026-15176) It was discovered that nginx incorrectly handled map directives usingregex matching under certain circumstances. A remote attacker couldpossibly use this issue to cause nginx to crash, resulting in a denial ofservice, or execute arbitrary code. (CVE-2026-93479) It was discovered that nginx incorrectly handled HTTP/3 requests whenproxy_request_buffering was enabled. This issue only affected Ubuntu 26.04LTS and Ubuntu 26.10. A remote attacker could possibly use this issue toinject data into proxied requests. (CVE-2026-95101) It was discovered that nginx incorrectly handled asynchronous file I/O incertain configurations with Server Side Includes pages. A remote attackercould possibly use this issue to cause nginx to crash, resulting in adenial of service, or execute arbitrary code. (CVE-2026-97205) It was discovered that nginx incorrectly handled SSL session ticket keyswhen configured with a shared session cache but without explicit ticketkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,and Ubuntu 26.10. A remote attacker could possibly use this issue to forgeclient SSL sessions and bypass client certificate verification.(CVE-2026-97629)