Vulnpedia
← Search CVEs

CVE-2026-97629

HIGH 8.3

Published 2026-10-14 · Last modified 2026-10-15

Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

ELEVATED IMPACT

Severe if exploited (CVSS 8.3), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 14th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

8.3CVSS 4.0 · HIGH

  • ConfidentialityHigh
  • IntegrityLow
  • AvailabilityNone

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable
  • ⚠Requirements: Specific conditions must be present

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors F5

Products Nginx Plus Nginx Open Source

Weakness (CWE)

  • CWE-908: Use of Uninitialized Resource

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 38 vendor product statements; 6 omitted. Read the full vendor advisory.

  • nginx-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-0:1.30.6-1.hum1@src as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=src&distro=hummingbird-20251124&repository_id=public-hummingbird-source-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-all-modules-0:1.30.6-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-all-modules-0:1.30.6-1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-all-modules-0:1.30.6-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-core-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-core-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-s390x-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-filesystem-0:1.30.6-1.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=noarch&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-devel-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-devel-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-geoip-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-geoip-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-geoip-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-image-filter-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-image-filter-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-perl-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-perl-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-perl-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-xslt-filter-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-http-xslt-filter-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-mail-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-mail-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-mail-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-stream-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-stream-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-stream-geoip-0:1.30.6-1.hum1@aarch64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=aarch64&distro=hummingbird-20251124&repository_id=public-hummingbird-aarch64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-stream-geoip-0:1.30.6-1.hum1@s390x as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=s390x&distro=hummingbird-20251124&repository_id=public-hummingbird-s390x-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • nginx-mod-stream-geoip-0:1.30.6-1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00
  • php.src as a component of Red Hat Hardened Images · known not affected

    Vendor assessment for this product only.

    Reason: component not present

    pkg:rpm/redhat/[email protected]?arch=src

    Red Hat · CVE-2026-97629 · Updated 2026-10-20T04:11:11+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

1 candidate
  • https://github.com/PhiNode-Labs/nginx-cve-2026-97629

    CVE-2026-97629 — nginx TLS session-ticket forgery that can bypass client-certificate (mTLS) authentication. Root cause, one-line patch, proof-of-concept exploit and reproduction evidence. Found and disclosed by PhiNode Labs; credited by F5. Fixed in nginx 1.31.7 / 1.30.6.

    PoC-in-GitHub · CVE-2026-97629
    PoC-in-GitHub · CVE-2026-97629 · Updated 2026-10-21T20:30:33Z

All CVSS metrics

  • MEDIUM 6.5 v3.1 · CNA Primary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
  • HIGH 8.3 v4.0 · CNA Primary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
  • HIGH 8.3 v4.0 · NVD Secondary
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • MEDIUM 6.5 v3.1 · NVD Secondary
    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS