CVE-2026-97629: NGINX ngx_http_ssl_module vulnerability
Description When NGINX Plus or NGINX Open Source is configured with sslsessioncache
shared:name:size
without an explicit sslsessionticketkey file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions
in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.
Impact
This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure explicit ssl_session_ticket_key file directives with ssl_session_cache shared:name:size to automatically rotate SSL session ticket keys.
NGINX Plus or NGINX Open Source ngx_http_ssl_module ssl_session_ticket_key = explicit file directives
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
NGINX Plus and NGINX Open Source deployments are affected when they use ssl_session_cache shared:name:size and do not explicitly configure ssl_session_ticket_key file directives for automatic SSL session ticket key rotation. The issue affects the data plane only; there is no control plane exposure.
Does exploitation require authentication or user interaction?
No. The described attacker is remote and unauthenticated, and no user interaction is required. Exploitation is non-deterministic and beyond the attacker's control.
What security control could be bypassed?
An attacker may be able to forge client SSL sessions and bypass client-certificate verification. This can expose resources or functionality to unintended actors and potentially allow access to sensitive information.
What configuration change is relevant if patching cannot be performed immediately?
Explicitly configure ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys in deployments using a shared ssl_session_cache. The vulnerability description identifies the absence of these directives as part of the affected configuration.