CVE-2026-97629
Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control
CVE-2026-97629: Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit…
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2026-97629 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- High
- CVSS base score
- 8.3 (F5), 6.5 (Red Hat)
- Weakness
- CWE-295
- Fixed releases
- F5: 37.1.0.1, 37.0.5.1, 1.31.7, 1.30.6
- Red Hat: nginx-main-1.30.6-1.hum1, RHSA-2026:83427
- VulniPulse record
- Published · Updated
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-97629; bulletin-wide values are not repeated here.
Is CVE-2026-97629 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2026-97629 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2026-97629?
Upgrade to a fixed release named by the vendor:
- F5: 37.1.0.1, 37.0.5.1, 1.31.7, 1.30.6
- Red Hat: nginx-main-1.30.6-1.hum1, RHSA-2026:83427
- Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. (F5)
Vendor advisory comparison
F5
1 advisory- Advisory severityHigh8.3
High [CVE-2026-97629] Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control
CVE-2026-97629Source published Source updated
When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control. An attacker could leverage this vulnerability to bypass verification of client certificates. Impact This vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Affected products in this advisory
- NGINX Plus
- NGINX Open Source
- Source-reported affected versions
- NGINX Plus 37.1.0 before 37.1.0.1
- NGINX Plus 37.0.0 before 37.0.5.1
- NGINX Plus R36
- NGINX Plus R35
5 more entries in the full advisory.
- Source-reported fixed versions
- 37.1.0.1
- 37.0.5.1
- 1.31.7
- 1.30.6
- Mitigation guidance
- Description When NGINX Plus or NGINX Open Source is configured with ssl_session_cache shared:name:size without an explicit ssl_session_ticket_key file directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions in a non-deterministic manner that is beyond the attacker's control.
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-97629] Client certificate verification bypass via forged SSL sessions
CVE-2026-97629Source published Source updated
Client certificate verification bypass via forged SSL sessions. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:83427 with package nginx-main-1.30.6-1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
- Related products — impact not confirmed
- Red Hat Hardened Images
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- nginx-main-1.30.6-1.hum1
- RHSA-2026:83427
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.