Public bug reported:
A new release of nginx is available for merging from Debian.
Ubuntu: 1.30.4-7ubuntu1
Debian Unstable: 1.30.4-8
### New Debian Changes ###
nginx (1.30.4-8) unstable; urgency=high
* Backport security fixes from upstream 1.30.6:
- d/p/CVE-2026-15176.patch: reject URI to path mapping with alias
after a rewrite changed the URI (CVE-2026-15176).
- d/p/CVE-2026-93479.patch: protect reserved memory when evaluating
string expressions in HTTP and stream modules (CVE-2026-93479).
- d/p/CVE-2026-95101.patch: keep skipped HTTP/3 frame payload separate
from request body data, preserving nginx-dev ABI compatibility
(CVE-2026-95101).
- d/p/CVE-2026-97629.patch: initialize all worker session ticket keys
during key rotation (CVE-2026-97629.patch).
- d/p/CVE-2026-97205.patch: limit pending asynchronous operations
to prevent the request blocked counter from overflowing (CVE-2026-97205).
-- Jan Mojžíš <[email protected]> Thu, 15 Oct 2026 01:33:49 +0000
### Old Ubuntu Delta ###
nginx (1.30.4-7ubuntu1) stonking; urgency=low
* Merge from Debian unstable. Remaining changes:
- Branding for Ubuntu
+ Configure with --build=Ubuntu build flag.
+ Use server_tokens build, to make the branding effective
+ d/t/branding: Add autopkgtest to validate branding presence
-- Gianfranco Costamagna <[email protected]> Mon, 28 Sep 2026
14:38:51 +0200
** Affects: nginx (Ubuntu)
Importance: Wishlist
Status: New
** Tags: needs-merge upgrade-software-version
** Changed in: nginx (Ubuntu)
Importance: Undecided => Wishlist
** Changed in: nginx (Ubuntu)
Milestone: None => ubuntu-26.11
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171142
Title:
Merge nginx 1.30.4-8 from Debian for tenacious cycle
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/nginx/+bug/2171142/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
