{"id":"CVE-2026-97629","aliases":["ALPINE-CVE-2026-97629","AZL-108458","BELL-CVE-2026-97629","BIT-nginx-2026-97629","BIT-nginx-gateway-2026-97629","DEBIAN-CVE-2026-97629","EUVD-2026-101113","GHSA-qhwc-5g9q-3669","OESA-2026-4544","OESA-2026-4545","OESA-2026-4546","RHSA-2026:83427","ROOT-OS-ALPINE-315-CVE-2026-97629","ROOT-OS-ALPINE-321-CVE-2026-97629","ROOT-OS-ALPINE-323-CVE-2026-97629","UBUNTU-CVE-2026-97629","USN-8955-1","openSUSE-SU-2026:12143-1"],"status":"published","title":"NGINX ngx_http_ssl_module vulnerability","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","severity":{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00246,"percentile":0.15911,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-908"],"published":"2026-10-14T14:40:26Z","modified":"2026-11-03T15:15:05Z","exploits":[{"source":"pocgithub","id":"PhiNode-Labs/nginx-cve-2026-97629","title":"PhiNode-Labs/nginx-cve-2026-97629","date":"2026-10-21","url":"https://github.com/PhiNode-Labs/nginx-cve-2026-97629"}],"fixes":[{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"nginx","fixed_in":["1.30.6-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","fixed_in":["1.30.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.30.6","1.31.7"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["2.2.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.26.3-3+deb13u10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.30.4-8"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"nginx","fixed_in":["1.20.2-r20076","1.20.2-r20077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-nginx","fixed_in":["1.20.2-r20076","1.20.2-r20077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"nginx","fixed_in":["1.26.3-r30073","1.26.3-r30074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.21","package":"rootio-nginx","fixed_in":["1.26.3-r30073","1.26.3-r30074"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.23","package":"nginx","fixed_in":["1.28.3-r70071"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.23","package":"rootio-nginx","fixed_in":["1.28.3-r70071"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"nginx","fixed_in":["1.24.0-2ubuntu7.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.10","package":"nginx","fixed_in":["1.30.4-7ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"nginx","fixed_in":["1.28.3-2ubuntu1.12"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.6-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.28.0-r3"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.1-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"nginx-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.30.3-r0"},{"fixed":"1.30.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.29"},{"fixed":"1.30.6"},{"introduced":"1.31.0"},{"fixed":"1.31.7"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"0.1.29"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.1-9","1.22.1-9+deb12u1","1.22.1-9+deb12u10","1.22.1-9+deb12u2","1.22.1-9+deb12u3","1.22.1-9+deb12u4","1.22.1-9+deb12u5","1.22.1-9+deb12u6","1.22.1-9+deb12u7","1.22.1-9+deb12u8","1.22.1-9+deb12u9","1.24.0-1","1.24.0-1~exp1","1.24.0-2","1.26.0-1","1.26.0-1~exp1","1.26.0-2","1.26.0-3","1.26.2-1","1.26.3-1","1.26.3-2","1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7","1.30.4-8","1.30.6-1","1.30.6-2"]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-3+deb13u10"}]}],"versions":["1.26.3-3","1.26.3-3+deb13u1","1.26.3-3+deb13u2","1.26.3-3+deb13u3","1.26.3-3+deb13u4","1.26.3-3+deb13u5","1.26.3-3+deb13u6","1.26.3-3+deb13u7","1.26.3-3+deb13u8","1.26.3-3+deb13u9"]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-8"}]}],"versions":["1.26.3-3","1.28.0-1","1.28.0-2","1.28.0-3","1.28.0-4","1.28.0-5","1.28.0-6","1.28.1-1","1.28.1-2","1.28.1-3","1.28.2-1","1.28.2-2","1.28.2-3","1.28.2-4","1.28.3-1","1.28.3-2","1.30.0-1","1.30.0-2","1.30.0-3","1.30.0-4","1.30.1-1","1.30.1-2","1.30.1-3","1.30.1-4","1.30.1-5","1.30.1-6","1.30.1-7","1.30.4-1","1.30.4-2","1.30.4-3","1.30.4-4","1.30.4-5","1.30.4-6","1.30.4-7"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-16.oe2403sp1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-15.oe2403sp3"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-15.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nginx-mod-stream-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.30.6-1.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-r20076"},{"fixed":"1.20.2-r20077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-r20076"},{"fixed":"1.20.2-r20077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-r30073"},{"fixed":"1.26.3-r30074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.21","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.3-r30073"},{"fixed":"1.26.3-r30074"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r70071"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.23","package":"rootio-nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-r70071"}]}]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.22"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14","1.18.0-6ubuntu14.1","1.18.0-6ubuntu14.2","1.18.0-6ubuntu14.3","1.18.0-6ubuntu14.4","1.18.0-6ubuntu14.5","1.18.0-6ubuntu14.6","1.18.0-6ubuntu14.7","1.18.0-6ubuntu14.8","1.18.0-6ubuntu14.10","1.18.0-6ubuntu14.11","1.18.0-6ubuntu14.12","1.18.0-6ubuntu14.13","1.18.0-6ubuntu14.14","1.18.0-6ubuntu14.15","1.18.0-6ubuntu14.16","1.18.0-6ubuntu14.17","1.18.0-6ubuntu14.18","1.18.0-6ubuntu14.19","1.18.0-6ubuntu14.20","1.18.0-6ubuntu14.21"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2ubuntu7.19"}]}],"versions":["1.24.0-1ubuntu1","1.24.0-2ubuntu1","1.24.0-2ubuntu2","1.24.0-2ubuntu3","1.24.0-2ubuntu4","1.24.0-2ubuntu6","1.24.0-2ubuntu7","1.24.0-2ubuntu7.1","1.24.0-2ubuntu7.3","1.24.0-2ubuntu7.4","1.24.0-2ubuntu7.5","1.24.0-2ubuntu7.6","1.24.0-2ubuntu7.7","1.24.0-2ubuntu7.8","1.24.0-2ubuntu7.9","1.24.0-2ubuntu7.10","1.24.0-2ubuntu7.11","1.24.0-2ubuntu7.12","1.24.0-2ubuntu7.13","1.24.0-2ubuntu7.14","1.24.0-2ubuntu7.15","1.24.0-2ubuntu7.16","1.24.0-2ubuntu7.17","1.24.0-2ubuntu7.18"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.4-7ubuntu1.1"}]}],"versions":["1.28.3-2ubuntu1","1.30.1-4ubuntu1","1.30.1-6ubuntu1","1.30.4-5ubuntu1","1.30.4-7ubuntu1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2ubuntu1.12"}]}],"versions":["1.28.0-6ubuntu1","1.28.1-2ubuntu1","1.28.1-3ubuntu1","1.28.2-2ubuntu1","1.28.3-2ubuntu1","1.28.3-2ubuntu1.1","1.28.3-2ubuntu1.2","1.28.3-2ubuntu1.3","1.28.3-2ubuntu1.4","1.28.3-2ubuntu1.5","1.28.3-2ubuntu1.6","1.28.3-2ubuntu1.7","1.28.3-2ubuntu1.8","1.28.3-2ubuntu1.9","1.28.3-2ubuntu1.10","1.28.3-2ubuntu1.11"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.7-1.1"}]}],"bundled":5}],"products":[{"vendor":"f5","product":"nginx open source"},{"vendor":"f5","product":"nginx plus"}],"references":[{"url":"https://my.f5.com/manage/s/article/K000162606","tags":["vendor-advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97629","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-qhwc-5g9q-3669"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-97629","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-97629","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97629","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4544","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97205","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4545","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4546","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:83427","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15176","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97205","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97629","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-95101","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83427.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15176","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162416","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552355","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-95101","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95101","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162613","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97205","tags":["advisory"]},{"url":"https://my.f5.com/manage/s/article/K000162608","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2552364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97629","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2026-97629","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8955-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-93479","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-95101","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97205","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-93479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-95101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-97629","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-97629","title":"NGINX ngx_http_ssl_module vulnerability","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:26.74Z","modified":"2026-10-29T16:59:42.33Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-101113","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T14:40:26Z","modified":"2026-10-29T16:59:42Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:15.737898Z"}],"ghsa":[{"id":"GHSA-qhwc-5g9q-3669","title":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared...","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:32:30Z","modified":"2026-10-14T15:32:39Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T15:13:26.117603Z"}],"nvd":[{"id":"CVE-2026-97629","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28.6Z","modified":"2026-10-15T17:17:33.41Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-908"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"ALPINE-CVE-2026-97629","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28.6Z","modified":"2026-10-22T11:30:02.506872138Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"BELL-CVE-2026-97629","status":"published","published":"2026-10-20T06:09:07.919434Z","modified":"2026-10-22T08:30:05.395193219Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"DEBIAN-CVE-2026-97629","description":"Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache   shared:name:size  without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions   in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.  Impact   This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.       Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28.6Z","modified":"2026-10-21T17:01:59.753933274Z","cvss":[{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:46:07.756422Z"},{"id":"OESA-2026-4544","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:46Z","modified":"2026-10-29T09:15:26.178757646Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4545","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:46Z","modified":"2026-10-29T09:15:27.099239173Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"OESA-2026-4546","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact: \nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)","status":"published","published":"2026-10-29T09:02:47Z","modified":"2026-10-29T09:15:27.522745084Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.981622Z"},{"id":"RHSA-2026:83427","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-16T10:27:21Z","modified":"2026-10-20T10:43:38.614397927Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"UBUNTU-CVE-2026-97629","description":"Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-26T22:34:48.21484313Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","level":"medium"},{"version":"4.0","score":8.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:48.647391Z"},{"id":"AZL-108458","title":"CVE-2026-97629 affecting package nginx for versions less than 1.30.6-1","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-14T15:17:28Z","modified":"2026-11-02T14:16:58.092833175Z","updated_at":"2026-11-02T15:28:01.725816Z"},{"id":"BIT-nginx-2026-97629","title":"NGINX ngx_http_ssl_module vulnerability","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:54:07.09Z","modified":"2026-10-21T12:11:26.338311081Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2026-97629","title":"NGINX ngx_http_ssl_module vulnerability","description":"Description\nWhen NGINX Plus or NGINX Open Source is configured with ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.","status":"published","published":"2026-10-21T08:54:20.94Z","modified":"2026-10-21T12:11:26.338311081Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"openSUSE-SU-2026:12143-1","title":"nginx-1.31.7-1.1 on GA media","description":"These are all security issues fixed in the nginx-1.31.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-10-15T00:00:00Z","modified":"2026-10-16T17:23:13.464278658Z","updated_at":"2026-11-02T16:58:40.245664Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2026-97629","title":"CVE-2026-97629 in nginx - Patched by Root","description":"Root has patched CVE-2026-97629 in the nginx package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-02T10:27:11Z","modified":"2026-11-02T11:15:02.793033738Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"ROOT-OS-ALPINE-321-CVE-2026-97629","title":"CVE-2026-97629 in nginx - Patched by Root","description":"Root has patched CVE-2026-97629 in the nginx package for Root:Alpine:3.21. Multiple fixed versions available.","status":"published","published":"2026-11-03T14:41:12Z","modified":"2026-11-03T15:15:05.398198987Z","updated_at":"2026-11-03T15:57:39.116496Z"},{"id":"ROOT-OS-ALPINE-323-CVE-2026-97629","title":"CVE-2026-97629 in nginx - Patched by Root","description":"Root has patched CVE-2026-97629 in the nginx package for Root:Alpine:3.23. Multiple fixed versions available.","status":"published","published":"2026-11-03T08:21:49Z","modified":"2026-11-03T09:15:03.094633067Z","updated_at":"2026-11-03T09:26:33.868904Z"},{"id":"USN-8955-1","title":"nginx vulnerabilities","description":"It was discovered that nginx incorrectly handled certain configurations\nusing the alias directive together with rewrite rules. A remote attacker\ncould possibly use this issue to cause nginx to crash, resulting in a\ndenial of service, or execute arbitrary code.\n(CVE-2026-15176)\n\nIt was discovered that nginx incorrectly handled map directives using\nregex matching under certain circumstances. A remote attacker could\npossibly use this issue to cause nginx to crash, resulting in a denial\nof service, or execute arbitrary code.\n(CVE-2026-93479)\n\nIt was discovered that nginx incorrectly handled HTTP/3 requests when\nproxy_request_buffering was enabled. This issue only affected\nUbuntu 26.04 LTS and Ubuntu 26.10. A remote attacker could possibly use\nthis issue to inject data into proxied requests.\n(CVE-2026-95101)\n\nIt was discovered that nginx incorrectly handled asynchronous file I/O\nin certain configurations with Server Side Includes pages. A remote\nattacker could possibly use this issue to cause nginx to crash,\nresulting in a denial of service, or execute arbitrary code.\n(CVE-2026-97205)\n\nIt was discovered that nginx incorrectly handled SSL session ticket keys\nwhen configured with a shared session cache but without explicit ticket\nkey rotation. This issue only affected Ubuntu 24.04 LTS, Ubuntu 26.04 LTS,\nand Ubuntu 26.10. A remote attacker\ncould possibly use this issue to forge client SSL sessions and bypass\nclient certificate verification.\n(CVE-2026-97629)","status":"published","published":"2026-10-26T15:34:05Z","modified":"2026-10-26T22:46:19.977872622Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}