Every CVE Search/ Get API key

CVE-2025-23419

TLS Session Resumption Vulnerability

5.3 MediumPublic exploitFix available

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

2.79%Up 2.8 points since Feb 6, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.3

TLS Session Resumption Vulnerability

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2025-23419
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2025-3168 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
EUVD-2025-3168
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-84xh-pwc6-7g4g 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can...

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
GHSA-84xh-pwc6-7g4g
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-287, CWE-613, CWE-863
Updated
2026-11-02
NVD 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2025-23419
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVALPINE-CVE-2025-23419 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
ALPINE-CVE-2025-23419
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVBELL-CVE-2025-23419 4.3
Record
BELL-CVE-2025-23419
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
Show 17 moreShow less
OSV 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
CVE-2025-23419
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVDEBIAN-CVE-2025-23419 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
DEBIAN-CVE-2025-23419
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2025-1134 4.3

nginx security update

NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server.

Security Fix(es):

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2025-23419)

Record
OESA-2025-1134
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2025:7331 4.3

Red Hat Security Advisory: nginx security update

Record
RHSA-2025:7331
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-23419 5.3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
UBUNTU-CVE-2025-23419
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-05
OSVAZL-56483 No score

CVE-2025-23419 affecting package nginx for versions less than 1.22.1-13

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
AZL-56483
Updated
2026-11-02
OSVAZL-56492 No score

CVE-2025-23419 affecting package nginx for versions less than 1.25.4-3

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
AZL-56492
Updated
2026-11-02
OSVBIT-nginx-2025-23419 No score

TLS Session Resumption Vulnerability

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
BIT-nginx-2025-23419
Updated
2026-11-02
OSVBIT-nginx-gateway-2025-23419 No score

TLS Session Resumption Vulnerability

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Record
BIT-nginx-gateway-2025-23419
Updated
2026-11-02
OSVCLSA-2025-1752516250 No score

nginx: Fix of CVE-2025-23419

  • CVE-2025-23419: fix issue allowing session resumption to bypass client certificate authentication when multiple server blocks share same IP/port
Record
CLSA-2025-1752516250
Updated
2026-11-02
OSVMGASA-2025-0051 No score

Updated nginx packages fix security vulnerability

TLS Session Resumption Vulnerability. (CVE-2025-23419)

Record
MGASA-2025-0051
Updated
2026-11-02
OSVopenSUSE-SU-2025:14737-1 No score

nginx-1.27.4-1.1 on GA media

These are all security issues fixed in the nginx-1.27.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14737-1
Updated
2026-11-02
OSVSUSE-SU-2025:03089-1 No score

Security update for nginx

This update for nginx fixes the following issues:

  • CVE-2025-53859: the server side may leak arbitrary bytes during the NGINX SMTP authentication process (bsc#1248070).
  • CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3 (bsc#1236851).
Record
SUSE-SU-2025:03089-1
Updated
2026-11-02
OSVSUSE-SU-2025:03243-1 No score

Security update for nginx

This update for nginx fixes the following issues:

  • CVE-2025-53859: the server side may leak arbitrary bytes during the NGINX SMTP authentication process (bsc#1248070).
  • CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3 (bsc#1236851).
Record
SUSE-SU-2025:03243-1
Updated
2026-11-02
OSVSUSE-SU-2025:03444-1 No score

Security update for nginx

This update for nginx fixes the following issues:

  • CVE-2025-53859:�the server side may leak arbitrary bytes during the NGINX SMTP authentication process (bsc#1248070).
  • CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3 (bsc#1236851).
Record
SUSE-SU-2025:03444-1
Updated
2026-11-02
OSVUSN-7285-1 No score

nginx vulnerability

It was discovered that nginx incorrectly handled when multiple server blocks are configured to share the same IP address and port. An attacker could use this issue to use session resumption to bypass client certificate authentication requirements on these servers. This issue only affected Ubuntu 24.10.

A buffer overflow and a null pointer deref was fixed in nginx rtmp module (#LP 1977718). This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.

Record
USN-7285-1
Updated
2026-11-02
OSVUSN-7285-2 No score

nginx vulnerability

USN-7285-1 fixed vulnerabilities in nginx. This update provides the corresponding updates for Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that nginx incorrectly handled when multiple server blocks are configured to share the same IP address and port. An attacker could use this issue to use session resumption to bypass client certificate authentication requirements on these servers.

Record
USN-7285-2
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nginx
Alpine:v3.20
 1.11.4 up to 1.26.3-r0
1.26.3-r0
nginx
Alpine:v3.21
 1.11.4 up to 1.26.3-r0
1.26.3-r0
nginx
Alpine:v3.22
 1.11.4 up to 1.26.3-r0
1.26.3-r0
nginx
Alpine:v3.23
 1.11.4 up to 1.26.3-r0
1.26.3-r0
nginx
Alpine:v3.24
 1.11.4 up to 1.26.3-r0
1.26.3-r0
nginx
Azure Linux:2
 before 1.22.1-13
1.22.1-13
nginx
Azure Linux:3
 before 1.25.4-3
1.25.4-3
nginx
Alpaquita:23
 1.22.1-r0 up to 1.22.1-r2
1.22.1-r2
nginx
Alpaquita:stream
 1.22.1-r0 up to 1.26.3-r0
1.26.3-r0
nginx
Bitnami
 1.11.4 up to 1.26.3, 1.27.0 up to 1.27.4
1.26.31.27.4
Show 54 moreShow less
Affected packages
PackageAffectedFixed
nginx-gateway
Bitnami
 1.11.4 up to 1.26.3, 1.27.0 up to 1.27.4
1.26.31.27.4
nginx
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-all-modules
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-core
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-filesystem
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-mod-devel
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-mod-http-image-filter
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-mod-http-perl
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-mod-http-xslt-filter
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-mod-mail
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx-mod-stream
TuxCare:AlmaLinux:9.2
 before 1:1.20.1-14.el9.1.alma.1.tuxcare.els3
1:1.20.1-14.el9.1.alma.1.tuxcare.els3
nginx
Debian:12
 before 1.22.1-9+deb12u1, plus listed versions
1.22.1-9
1.22.1-9+deb12u1
nginx
Debian:13
 before 1.26.3-2
1.26.3-2
nginx
Debian:14
 before 1.26.3-2
1.26.3-2
nginx
Debian:11
From an advisory covering 2 CVEs
 before 1.18.0-6.1+deb11u4, plus listed versions
1.18.0-6.11.18.0-6.1+deb11u11.18.0-6.1+deb11u21.18.0-6.1+deb11u3
1.18.0-6.1+deb11u4
nginx
Mageia:9
 before 1.26.3-1.mga9
1.26.3-1.mga9
nginx
openEuler:24.03-LTS
 before 1.24.0-4.oe2403sp1
1.24.0-4.oe2403sp1
nginx
openEuler:24.03-LTS-SP1
 before 1.24.0-4.oe2403sp1
1.24.0-4.oe2403sp1
nginx
openEuler:20.03-LTS-SP4
 before 1.21.5-6.oe2003sp4
1.21.5-6.oe2003sp4
nginx
openEuler:22.03-LTS-SP3
 before 1.21.5-8.oe2203sp3
1.21.5-8.oe2203sp3
nginx
openEuler:22.03-LTS-SP4
 before 1.21.5-8.oe2203sp4
1.21.5-8.oe2203sp4
nginx
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-all-modules
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-core
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-core-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-debugsource
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-filesystem
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-image-filter
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-image-filter-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-perl
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-perl-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-xslt-filter
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-xslt-filter-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-mail
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-mail-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-stream
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-stream-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-core-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-debugsource
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-devel
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-image-filter-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-perl-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-http-xslt-filter-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-mail-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx-mod-stream-debuginfo
Red Hat:enterprise_linux:9::crb
 before 2:1.20.1-22.el9
2:1.20.1-22.el9
nginx
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
1.4.1-3ubuntu11.4.3-2ubuntu11.4.4-1ubuntu11.4.4-2ubuntu11.4.4-4ubuntu1
Show 20 moreShow less
1.4.5-1ubuntu11.4.6-1ubuntu21.4.6-1ubuntu31.4.6-1ubuntu3.11.4.6-1ubuntu3.21.4.6-1ubuntu3.31.4.6-1ubuntu3.41.4.6-1ubuntu3.51.4.6-1ubuntu3.61.4.6-1ubuntu3.71.4.6-1ubuntu3.81.4.6-1ubuntu3.91.4.6-1ubuntu3.9+esm11.4.6-1ubuntu3.9+esm21.4.6-1ubuntu3.9+esm31.4.6-1ubuntu3.9+esm41.4.6-1ubuntu3.9+esm51.4.6-1ubuntu3.9+esm61.4.6-1ubuntu3.9+esm81.4.6-1ubuntu3.9+esm9
 None known
nginx
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
1.9.3-1ubuntu11.9.6-2ubuntu11.9.6-2ubuntu21.9.9-0ubuntu11.9.9-1ubuntu1
Show 26 moreShow less
1.9.10-0ubuntu11.9.10-1ubuntu11.9.11-0ubuntu11.9.11-0ubuntu21.9.12-0ubuntu11.9.13-0ubuntu11.9.14-0ubuntu11.9.15-0ubuntu11.10.0-0ubuntu0.16.04.11.10.0-0ubuntu0.16.04.21.10.0-0ubuntu0.16.04.31.10.0-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.11.10.3-0ubuntu0.16.04.21.10.3-0ubuntu0.16.04.31.10.3-0ubuntu0.16.04.41.10.3-0ubuntu0.16.04.51.10.3-0ubuntu0.16.04.5+esm11.10.3-0ubuntu0.16.04.5+esm21.10.3-0ubuntu0.16.04.5+esm31.10.3-0ubuntu0.16.04.5+esm41.10.3-0ubuntu0.16.04.5+esm51.10.3-0ubuntu0.16.04.5+esm61.10.3-0ubuntu0.16.04.5+esm71.10.3-0ubuntu0.16.04.5+esm91.10.3-0ubuntu0.16.04.5+esm10
 None known
nginx
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.12.1-0ubuntu21.13.6-2ubuntu11.13.6-2ubuntu21.13.10-1ubuntu11.13.12-0ubuntu1
Show 15 moreShow less
1.14.0-0ubuntu11.14.0-0ubuntu1.11.14.0-0ubuntu1.21.14.0-0ubuntu1.31.14.0-0ubuntu1.41.14.0-0ubuntu1.51.14.0-0ubuntu1.61.14.0-0ubuntu1.71.14.0-0ubuntu1.91.14.0-0ubuntu1.101.14.0-0ubuntu1.111.14.0-0ubuntu1.11+esm11.14.0-0ubuntu1.11+esm21.14.0-0ubuntu1.11+esm41.14.0-0ubuntu1.11+esm5
 None known
nginx
Ubuntu:20.04:LTS
 before 1.18.0-0ubuntu1.7, plus listed versions
1.16.1-0ubuntu21.16.1-0ubuntu31.17.5-0ubuntu11.17.6-0ubuntu11.17.7-0ubuntu1
Show 13 moreShow less
1.17.8-0ubuntu11.17.8-0ubuntu21.17.8-0ubuntu31.17.9-0ubuntu11.17.9-0ubuntu21.17.9-0ubuntu31.17.10-0ubuntu11.18.0-0ubuntu11.18.0-0ubuntu1.21.18.0-0ubuntu1.31.18.0-0ubuntu1.41.18.0-0ubuntu1.51.18.0-0ubuntu1.6
1.18.0-0ubuntu1.7
nginx
Ubuntu:22.04:LTS
 before 1.18.0-6ubuntu14.6, plus listed versions
1.18.0-6ubuntu111.18.0-6ubuntu121.18.0-6ubuntu141.18.0-6ubuntu14.11.18.0-6ubuntu14.21.18.0-6ubuntu14.31.18.0-6ubuntu14.41.18.0-6ubuntu14.5
1.18.0-6ubuntu14.6
nginx
Ubuntu:24.04:LTS
 before 1.24.0-2ubuntu7.3, plus listed versions
1.24.0-1ubuntu11.24.0-2ubuntu11.24.0-2ubuntu21.24.0-2ubuntu31.24.0-2ubuntu41.24.0-2ubuntu61.24.0-2ubuntu71.24.0-2ubuntu7.1
1.24.0-2ubuntu7.3
nginx
openSUSE:Tumbleweed
 before 1.27.4-1.1
1.27.4-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubharley-ghostie/safe-check-CVE-2025-234192025-12-17
PoC in GitHubxitexploiter96-dot/CVE-2025-234192026-03-29

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-23419 is a medium vulnerability (CVSS 5.3) in F5 Nginx, published February 5, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in nginx 1.26.3-r0.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open