Every CVE Search/ Get API key

CVE-2014-3616

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key...

4.3 MediumFix available

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Exploit likelihood

5.65%Up 4.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
CVE-2014-3616
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-613
Updated
2026-11-02
CVE List No score

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
CVE-2014-3616
Updated
2026-11-02
EUVDEUVD-2014-3580 No score

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
EUVD-2014-3580
Updated
2026-11-03
GitHub AdvisoriesGHSA-ch64-2v27-7pwp No score

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key...

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
GHSA-ch64-2v27-7pwp
Weakness
CWE-613
Updated
2026-11-02
OSV No score

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
CVE-2014-3616
Updated
2026-11-02
OSVDEBIAN-CVE-2014-3616 No score

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
DEBIAN-CVE-2014-3616
Updated
2026-11-02
Show 4 moreShow less
OSVMGASA-2014-0427 No score

Updated nginx packages fix CVE-2014-3616

Updated nginx package fixes security vulnerability:

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that it was possible to reuse cached SSL sessions in unrelated contexts, allowing virtual host confusion attacks in some configurations by an attacker in a privileged network position (CVE-2014-3616).

Record
MGASA-2014-0427
Updated
2026-11-02
OSVopenSUSE-SU-2024:10044-1 No score

nginx-1.11.4-2.5 on GA media

These are all security issues fixed in the nginx-1.11.4-2.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10044-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-3616 No score

nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.

Record
UBUNTU-CVE-2014-3616
Updated
2026-11-02
OSVUSN-2351-1 No score

nginx vulnerability

Antoine Delignat-Lavaud and Karthikeyan Bhargavan discovered that nginx incorrectly reused cached SSL sessions. An attacker could possibly use this issue in certain configurations to obtain access to information from a different virtual host.

Record
USN-2351-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Debian:12
 before 1.6.2-1
1.6.2-1
nginx
Debian:13
 before 1.6.2-1
1.6.2-1
nginx
Debian:14
 before 1.6.2-1
1.6.2-1
nginx
Debian:6.0
 before 0.7.67-3+squeeze4, plus listed versions
0.7.67-30.7.67-3+squeeze10.7.67-3+squeeze20.7.67-3+squeeze3
0.7.67-3+squeeze4
nginx
Debian:7
 before 1.2.1-2.2+wheezy3, plus listed versions
1.2.1-2.21.2.1-2.2+wheezy11.2.1-2.2+wheezy21.2.1-2.2+wheezy3~bpo60+1
1.2.1-2.2+wheezy3
nginx
Mageia:3
 before 1.2.9-1.3.mga3
1.2.9-1.3.mga3
nginx
Mageia:4
 before 1.4.7-1.1.mga4
1.4.7-1.1.mga4
nginx
Ubuntu:14.04:LTS
 before 1.4.6-1ubuntu3.1, plus listed versions
1.4.1-3ubuntu11.4.3-2ubuntu11.4.4-1ubuntu11.4.4-2ubuntu11.4.4-4ubuntu11.4.5-1ubuntu11.4.6-1ubuntu21.4.6-1ubuntu3
1.4.6-1ubuntu3.1
nginx
openSUSE:Tumbleweed
From an advisory covering 11 CVEs
 before 1.11.4-2.5
1.11.4-2.5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-3616 is a medium vulnerability (CVSS 4.3) in F5 Nginx, published September 17, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.65%, the 93rd percentile. Fixed in nginx 1.6.2-1.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open