CVE-2025-23419: TLS Session Resumption Vulnerability
First published: Wed Feb 05 2025(Updated: )
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Credit: f5sirt@f5.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| NGINX Plus | =28 | 33 |
| NGINX Open Source | >=1.11.4<=1.27.3 | 1.27.431.26.33 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-23419?
CVE-2025-23419 is considered a high severity vulnerability due to its potential to bypass client certificate authentication.
How do I fix CVE-2025-23419?
To mitigate CVE-2025-23419, update NGINX Plus to version 28 or NGINX Open Source to a version beyond 1.27.3.
What type of attack does CVE-2025-23419 enable?
CVE-2025-23419 allows an authenticated attacker to bypass client certificate authentication using session resumption.
Which software is affected by CVE-2025-23419?
CVE-2025-23419 affects NGINX Plus version 28 and NGINX Open Source versions between 1.11.4 and 1.27.3.
What configurations are impacted by CVE-2025-23419?
CVE-2025-23419 impacts servers with name-based virtual hosts sharing the same IP address and port using TLS 1.3.
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/type
- agent/weakness
- agent/description
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-23419
- collector/nvd-api
- source/NVD
- agent/author
- agent/references
- agent/severity
- agent/source
- agent/last-modified-date
- agent/event
- agent/trending
- agent/tags
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/f5-advisory
- source/F5
- vendor/f5