nginx HTTP/2 Cookie Handling Flaw Patched After Regression
Ubuntu released USN-8398-3 to address CVE-2026-49975, a denial-of-service vulnerability in nginx's HTTP/2 cookie processing that was incompletely fixed in earlier updates. The final patch resolves resource exhaustion risks without introducing the regressions that plagued previous attempts.
TL;DR
- CVE-2026-49975 allows remote attackers to trigger excessive resource consumption in nginx via malformed HTTP/2 cookie headers
- Previous fix (USN-8398-1) caused regressions and was reverted; USN-8398-3 delivers a complete solution
- Affected systems should apply the latest patch to prevent denial-of-service attacks
- HTTP/2 implementations require careful handling of header parsing to avoid resource exhaustion
Ubuntu has released USN-8398-3, a critical security update addressing CVE-2026-49975 in nginx. This vulnerability affects the HTTP/2 implementation, where improper cookie header handling allows remote attackers to exhaust server resources and trigger denial-of-service conditions.
The patch represents the third attempt to resolve this issue. An initial fix (USN-8398-1) introduced regressions that forced a temporary revert (USN-8398-2). The current update provides a complete remediation without the side effects that plagued previous versions.
Organizations running nginx should prioritize applying this update to eliminate the resource exhaustion risk and maintain service availability.
Vulnerability Details
- HTTP/2 cookie header parsing flaw enables remote denial-of-service attacks
- Malformed cookies trigger excessive resource consumption on affected nginx instances
- No authentication required; attack can be initiated by any network-connected attacker
- Affects nginx deployments using HTTP/2 protocol support
Patch History & Resolution
- USN-8398-1 introduced initial fix but caused unintended regressions in production systems
- USN-8398-2 reverted the problematic patch to restore stability
- USN-8398-3 delivers comprehensive fix addressing root cause without side effects
- Organizations should skip earlier patches and apply USN-8398-3 directly
Remediation Guidance
- Apply USN-8398-3 to all Ubuntu systems running nginx with HTTP/2 enabled
- Test updates in staging environments before production deployment
- Monitor nginx logs for suspicious cookie-related errors post-update
- Verify HTTP/2 functionality remains intact after patching
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.