Zero Radar
← feed
HighVulnerabilityCVE-2026-97205updated 26 Oct 2026, 17:26 UTC

nginx web server: memory corruption and crashes from a request-handling flaw

A bug in the nginx web server can let a remote visitor crash it or corrupt its memory. Crashes take websites offline, and memory corruption can sometimes be turned into more serious control.

Fix availableOfficial, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesUpdated nginx packages published by Debian (DSA-6575-1) and Ubuntu (USN-8955-1). Specific fixed version numbers are not stated in the material. · since 26 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote visitorSends crafted requests to the server
  2. 2nginx processes requestServer Side Includes with async file I/O
  3. 3Counter overflowsRequest memory freed while still in use
  4. 4Memory corruptedUse-after-free in request handling
  5. ResultServer crashes or may run attacker code

What happened

An asynchronous operation counter in nginx can overflow, causing request memory to be freed while still in use (a use-after-free) when Server Side Includes pages are involved with asynchronous file I/O.

Why it is dangerous: Sites running affected nginx builds can suffer denial of service, and the memory corruption could potentially allow code execution. Web servers and reverse proxies exposed to the internet are most at risk.

Are you affected?

You are affected if you run nginx in a vulnerable version with asynchronous file I/O and Server Side Includes pages in your configuration.

Debian trixie nginx packages (per DSA-6575-1); Ubuntu nginx packages as listed in USN-8955-1 (exact versions not stated in the material).

What to do

  1. Update nginx using your distribution's security update (Debian DSA-6575-1 or Ubuntu USN-8955-1)
  2. Restart nginx after the update so the fixed binary is running
  3. If you cannot update right away, review whether Server Side Includes with asynchronous file I/O is enabled and consider disabling it

Timeline

  1. 21 Oct 2026, 00:00 UTC
    Publicly disclosed
  2. 21 Oct 2026, 00:00 UTC
    Reported by Debian DSA · Debian DSA
  3. 26 Oct 2026, 17:26 UTC
    Ubuntu Security reported on it · Ubuntu Security

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-97205
EPSS
0.8% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 00:00 UTC
On Zero Radar
before the radar started
Last change
26 Oct 2026, 17:26 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

nginx web server: memory corruption and crashes from a request-handling flaw · Zero Radar