NGINX ngx_http_ssl_module vulnerability
Impact
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
Source excerpt · f5What to do
Do not enable automatic rotation of SSL session ticket keys:
option a) remove the "ssl_session_cache shared:name:size" directive; https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
option b) switch to loading static ticket keys from a file using the "ssl_session_ticket_key" directive. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key
Systems that disable session tickets ("ssl_session_tickets off;") are not affected. https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
Affected packages
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
F5 · f5
NGINX Plus
6 ranges
F5 · f5
NGINX Plus
Compare with this publisher’s ranges. This does not inspect your installation.
affected
37.1.0 → before 37.1.0.1
custom versions
37.0.0 → before 37.0.5.1
custom versions
R36 → before *
custom versions
R35 → before *
custom versions
R34 → before *
custom versions
R33 → before *
custom versions
Other versions: unknown
F5 · f5
NGINX Open Source
3 ranges
F5 · f5
NGINX Open Source
Compare with this publisher’s ranges. This does not inspect your installation.
affected
1.31.0 → before 1.31.7
custom versions
1.30.0 → before 1.30.6
custom versions
1.23.3 → before *
custom versions
Other versions: unknown
Original source description
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
shared:name:size
without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions
in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.
Impact
This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-97629View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 2
Assigning organization
Additional data publisher
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.