NGINX ngx_http_ssl_module vulnerability
Summary
| CVE | CVE-2026-97629 |
|---|---|
| State | PUBLISHED |
| Assigner | f5 |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-14 15:17:28 UTC |
| Updated | 2026-10-15 17:17:33 UTC |
| Description | Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
Risk And Classification
Primary CVSS: v4.0 8.3 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-908 | CWE-908 CWE-908 Use of Uninitialized Resource
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.3 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.3 | HIGH | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
| 3.1 | CNA | CVSS | 6.5 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | F5 | NGINX Plus | affected 37.1.0 37.1.0.1 custom | Not specified |
| CNA | F5 | NGINX Plus | affected 37.0.0 37.0.5.1 custom | Not specified |
| CNA | F5 | NGINX Plus | affected R36 * custom | Not specified |
| CNA | F5 | NGINX Plus | affected R35 * custom | Not specified |
| CNA | F5 | NGINX Plus | affected R34 * custom | Not specified |
| CNA | F5 | NGINX Plus | affected R33 * custom | Not specified |
| CNA | F5 | NGINX Open Source | affected 1.31.0 1.31.7 custom | Not specified |
| CNA | F5 | NGINX Open Source | affected 1.30.0 1.30.6 custom | Not specified |
| CNA | F5 | NGINX Open Source | affected 1.23.3 * custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| my.f5.com/manage/s/article/K000162606 | [email protected] | my.f5.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: F5 acknowledges PhiNode Labs for bringing this issue to our attention and following the highest standards of coordinated disclosure (en)
Additional Advisory Data
Workarounds
CNA: Do not enable automatic rotation of SSL session ticket keys: option a) remove the "ssl_session_cache shared:name:size" directive; https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache option b) switch to loading static ticket keys from a file using the "ssl_session_ticket_key" directive. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key Systems that disable session tickets ("ssl_session_tickets off;") are not affected. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets