High [CVE-2026-97629] Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control
This high-severity F5 advisory covers CVE-2026-97629 affecting NGINX Plus, NGINX Open Source.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future F5 CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache
shared:name:size
without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions
in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates.
Impact
This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- NGINX Plus 37.1.0 before 37.1.0.1
- NGINX Plus 37.0.0 before 37.0.5.1
- NGINX Plus R36
- NGINX Plus R35
- NGINX Plus R34
- NGINX Plus R33
- NGINX Open Source 1.31.0 before 1.31.7
- NGINX Open Source 1.30.0 before 1.30.6
- NGINX Open Source 1.23.3
Official advisory · high-confidence parse· fetched 7 days ago·verify at source
- 37.1.0.1
- 37.0.5.1
- 1.31.7
- 1.30.6
Official advisory · high-confidence parse· fetched 7 days ago·verify at source
Mitigation checklist
- Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control.
Official advisory · high-confidence parse· fetched 7 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.