CVE-2026-97629: NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache
Other sources
When NGINX Plus or NGINX Open Source is configured with sslsessioncache shared:<name>:<size> without an explicit sslsessionticketkey file directive to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.
— F5
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/nginxto a version that resolves this vulnerability.Fixed in 1.26.3-3+deb13u10Fixed in 1.30.6-2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 37.0.5.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.71.30.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.24.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.16.05.14.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.11.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.8.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.7.0 - Upgrade
Upgrade
azurelinux/nginxto a version that resolves this vulnerability.Fixed in 1.30.6-1 - Configuration
Configure NGINX Plus or NGINX Open Source with an explicit ssl_session_ticket_key file directive to automatically rotate SSL session ticket keys when using ssl_session_cache shared:<name>:<size>.
NGINX ngx_http_ssl_module ssl_session_ticket_key = explicit file directive to automatically rotate SSL session ticket keys
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
NGINX Plus and NGINX Open Source deployments are affected when they use ssl_session_cache shared:name:size and do not explicitly configure ssl_session_ticket_key file directives for automatic SSL session ticket key rotation. The issue affects the data plane only; there is no control plane exposure.
Does exploitation require authentication or user interaction?
No. The described attacker is remote and unauthenticated, and no user interaction is required. Exploitation is non-deterministic and beyond the attacker's control.
What security control could be bypassed?
An attacker may be able to forge client SSL sessions and bypass client-certificate verification. This can expose resources or functionality to unintended actors and potentially allow access to sensitive information.
What configuration change is relevant if patching cannot be performed immediately?
Explicitly configure ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys in deployments using a shared ssl_session_cache. The vulnerability description identifies the absence of these directives as part of the affected configuration.