{
  "affected": [
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "nginx",
        "purl": "pkg:apk/alpaquita/nginx?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.1-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:23",
        "name": "nginx-base",
        "purl": "pkg:apk/alpaquita/nginx-base?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "nginx",
        "purl": "pkg:apk/alpaquita/nginx?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.28.0-r3"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:25",
        "name": "nginx-base",
        "purl": "pkg:apk/alpaquita/nginx-base?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "nginx",
        "purl": "pkg:apk/alpaquita/nginx?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.22.1-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Alpaquita:stream",
        "name": "nginx-base",
        "purl": "pkg:apk/alpaquita/nginx-base?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:23",
        "name": "nginx-base",
        "purl": "pkg:apk/bellsoft-hardened-containers/nginx-base?arch=source\u0026distro=23"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:25",
        "name": "nginx-base",
        "purl": "pkg:apk/bellsoft-hardened-containers/nginx-base?arch=source\u0026distro=25"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "BellSoft Hardened Containers:stream",
        "name": "nginx-base",
        "purl": "pkg:apk/bellsoft-hardened-containers/nginx-base?arch=source\u0026distro=stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.30.3-r0"
            },
            {
              "fixed": "1.30.6-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "id": "BELL-CVE-2026-97629",
  "modified": "2026-10-22T06:03:20.568637Z",
  "published": "2026-10-20T06:09:07.919434Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://docs.bell-sw.com/security/cves/CVE-2026-97629"
    }
  ],
  "schema_version": "1.7.4",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-97629"
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NGINX Open Source versions 1.x ant\u00e9rieures \u00e0 1.31.7",
      "product": {
        "name": "NGINX Open Source",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 WAF for NGINX versions 5.x ant\u00e9rieures \u00e0 5.16.0",
      "product": {
        "name": "F5 WAF for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus versions 37.x ant\u00e9rieures \u00e0 37.2.0",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Instance Manager versions 2.x ant\u00e9rieures \u00e0 2.24.0",
      "product": {
        "name": "NGINX Instance Manager",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 5.x ant\u00e9rieures \u00e0 5.7.0",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Gateway Fabric versions 2.x ant\u00e9rieures \u00e0 2.8.0",
      "product": {
        "name": "NGINX Gateway Fabric",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 DoS for NGINX versions 4.x ant\u00e9rieures \u00e0 4.11.0",
      "product": {
        "name": "F5 DoS for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-15176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15176"
    },
    {
      "name": "CVE-2026-97205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97205"
    },
    {
      "name": "CVE-2026-95101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95101"
    },
    {
      "name": "CVE-2026-93479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93479"
    },
    {
      "name": "CVE-2026-97629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97629"
    }
  ],
  "initial_release_date": "2026-10-15T00:00:00",
  "last_revision_date": "2026-10-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1317",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162613",
      "url": "https://my.f5.com/manage/s/article/K000162613"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162606",
      "url": "https://my.f5.com/manage/s/article/K000162606"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162416",
      "url": "https://my.f5.com/manage/s/article/K000162416"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162607",
      "url": "https://my.f5.com/manage/s/article/K000162607"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162608",
      "url": "https://my.f5.com/manage/s/article/K000162608"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "NGINX App Protect WAF versions 4.x",
      "product": {
        "name": "NGINX App Protect WAF",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX App Protect DoS versions 4.x",
      "product": {
        "name": "NGINX App Protect DoS",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Plus versions ant\u00e9rieures \u00e0 37.1.0.1 et 37.0.5.1",
      "product": {
        "name": "NGINX Plus",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions ant\u00e9rieures \u00e0 5.7.0",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Ingress Controller versions 2026-lts-r3 - 2026-lts-r8",
      "product": {
        "name": "NGINX Ingress Controller",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Javascript ant\u00e9rieures \u00e0 1.0.2",
      "product": {
        "name": "NGINX JavaScript (njs)",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Open Source versions 1.31.x ant\u00e9rieures \u00e0 1.31.7",
      "product": {
        "name": "NGINX Open Source",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 WAF for NGINX versions 5.x ant\u00e9rieures \u00e0 5.14.2 et 5.16.0",
      "product": {
        "name": "F5 WAF for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Instance Manager versions 2.x ant\u00e9rieures \u00e0 2.24.0",
      "product": {
        "name": "NGINX Instance Manager",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Open Source versions ant\u00e9rieures \u00e0 1.30.6",
      "product": {
        "name": "NGINX Open Source",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX Gateway Fabric versions ant\u00e9rieures \u00e0 2.8.0",
      "product": {
        "name": "NGINX Gateway Fabric",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "F5 DoS for NGINX versions 4.x ant\u00e9rieures \u00e0 4.11.0",
      "product": {
        "name": "F5 DoS for NGINX",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    },
    {
      "description": "NGINX App Protect WAF versions 5.x",
      "product": {
        "name": "NGINX App Protect WAF",
        "vendor": {
          "name": "F5",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-91184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-91184"
    },
    {
      "name": "CVE-2026-101019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101019"
    },
    {
      "name": "CVE-2026-96615",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-96615"
    },
    {
      "name": "CVE-2026-15176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-15176"
    },
    {
      "name": "CVE-2026-97205",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97205"
    },
    {
      "name": "CVE-2026-104939",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-104939"
    },
    {
      "name": "CVE-2026-101025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-101025"
    },
    {
      "name": "CVE-2026-95101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-95101"
    },
    {
      "name": "CVE-2026-94197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-94197"
    },
    {
      "name": "CVE-2026-93479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-93479"
    },
    {
      "name": "CVE-2026-97629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-97629"
    }
  ],
  "initial_release_date": "2026-10-19T00:00:00",
  "last_revision_date": "2026-10-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1341",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-10-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits F5. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits F5",
  "vendor_advisories": [
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000163408",
      "url": "https://my.f5.com/manage/s/article/K000163408"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162615",
      "url": "https://my.f5.com/manage/s/article/K000162615"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162613",
      "url": "https://my.f5.com/manage/s/article/K000162613"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162611",
      "url": "https://my.f5.com/manage/s/article/K000162611"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162606",
      "url": "https://my.f5.com/manage/s/article/K000162606"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162610",
      "url": "https://my.f5.com/manage/s/article/K000162610"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162416",
      "url": "https://my.f5.com/manage/s/article/K000162416"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162609",
      "url": "https://my.f5.com/manage/s/article/K000162609"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162607",
      "url": "https://my.f5.com/manage/s/article/K000162607"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162617",
      "url": "https://my.f5.com/manage/s/article/K000162617"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162614",
      "url": "https://my.f5.com/manage/s/article/K000162614"
    },
    {
      "published_at": "2026-10-14",
      "title": "Bulletin de s\u00e9curit\u00e9 F5 K000162608",
      "url": "https://my.f5.com/manage/s/article/K000162608"
    }
  ]
}

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_ssl_module"
          ],
          "product": "NGINX Plus",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "37.1.0.1",
              "status": "affected",
              "version": "37.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "37.0.5.1",
              "status": "affected",
              "version": "37.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "R36",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "R35",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "R34",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "R33",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "modules": [
            "ngx_http_ssl_module"
          ],
          "product": "NGINX Open Source",
          "vendor": "F5",
          "versions": [
            {
              "lessThan": "1.31.7",
              "status": "affected",
              "version": "1.31.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.30.6",
              "status": "affected",
              "version": "1.30.0",
              "versionType": "custom"
            },
            {
              "lessThan": "*",
              "status": "affected",
              "version": "1.23.3",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "f5sirt@f5.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Description\nWhen NGINX Plus or NGINX Open Source is configured with\u00a0ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file\u00a0directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0027s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated."
    }
  ],
  "id": "CVE-2026-97629",
  "lastModified": "2026-10-15T17:17:33.410",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.2,
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.3,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "LOW",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "f5sirt@f5.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-97629",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-15T15:52:47.244695Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-14T15:17:28.600",
  "references": [
    {
      "source": "f5sirt@f5.com",
      "url": "https://my.f5.com/manage/s/article/K000162606"
    }
  ],
  "sourceIdentifier": "f5sirt@f5.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-908"
        }
      ],
      "source": "f5sirt@f5.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-97629"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-908"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-14T15:17:28Z",
    "severity": "HIGH"
  },
  "details": "Description\nWhen NGINX Plus or NGINX Open Source is configured with\u00a0ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file\u00a0directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0027s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
  "id": "GHSA-qhwc-5g9q-3669",
  "modified": "2026-10-14T15:32:30Z",
  "published": "2026-10-14T15:32:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97629"
    },
    {
      "type": "WEB",
      "url": "https://my.f5.com/manage/s/article/K000162606"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "compat-nginx-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-debuginfo-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-debugsource-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-mod-http-image-filter-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-mod-http-perl-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-mod-http-xslt-filter-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-mod-mail-1.24.0-16.oe2403sp1.aarch64.rpm",
          "compat-nginx-mod-stream-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-debuginfo-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-debugsource-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-mod-devel-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-mod-http-image-filter-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-mod-http-perl-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-mod-http-xslt-filter-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-mod-mail-1.24.0-16.oe2403sp1.aarch64.rpm",
          "nginx-mod-stream-1.24.0-16.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "compat-nginx-all-modules-1.24.0-16.oe2403sp1.noarch.rpm",
          "compat-nginx-filesystem-1.24.0-16.oe2403sp1.noarch.rpm",
          "compat-nginx-help-1.24.0-16.oe2403sp1.noarch.rpm",
          "nginx-all-modules-1.24.0-16.oe2403sp1.noarch.rpm",
          "nginx-filesystem-1.24.0-16.oe2403sp1.noarch.rpm",
          "nginx-help-1.24.0-16.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "compat-nginx-1.24.0-16.oe2403sp1.src.rpm",
          "nginx-1.24.0-16.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "compat-nginx-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-debuginfo-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-debugsource-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-mod-http-image-filter-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-mod-http-perl-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-mod-http-xslt-filter-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-mod-mail-1.24.0-16.oe2403sp1.x86_64.rpm",
          "compat-nginx-mod-stream-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-debuginfo-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-debugsource-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-mod-devel-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-mod-http-image-filter-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-mod-http-perl-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-mod-http-xslt-filter-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-mod-mail-1.24.0-16.oe2403sp1.x86_64.rpm",
          "nginx-mod-stream-1.24.0-16.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "nginx",
        "purl": "pkg:rpm/openEuler/nginx\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.0-16.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\u00a0\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with\u00a0ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file\u00a0directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)",
  "id": "OESA-2026-4544",
  "modified": "2026-10-29T09:02:46Z",
  "published": "2026-10-29T09:02:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4544"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15176"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93479"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97205"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97629"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nginx security update",
  "upstream": [
    "CVE-2026-15176",
    "CVE-2026-93479",
    "CVE-2026-97205",
    "CVE-2026-97629"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "nginx-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-debuginfo-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-debugsource-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-mod-devel-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-mod-http-image-filter-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-mod-http-perl-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-mod-http-xslt-filter-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-mod-mail-1.24.0-15.oe2403sp3.aarch64.rpm",
          "nginx-mod-stream-1.24.0-15.oe2403sp3.aarch64.rpm"
        ],
        "noarch": [
          "nginx-all-modules-1.24.0-15.oe2403sp3.noarch.rpm",
          "nginx-filesystem-1.24.0-15.oe2403sp3.noarch.rpm",
          "nginx-help-1.24.0-15.oe2403sp3.noarch.rpm"
        ],
        "src": [
          "nginx-1.24.0-15.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "nginx-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-debuginfo-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-debugsource-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-mod-devel-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-mod-http-image-filter-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-mod-http-perl-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-mod-http-xslt-filter-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-mod-mail-1.24.0-15.oe2403sp3.x86_64.rpm",
          "nginx-mod-stream-1.24.0-15.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "nginx",
        "purl": "pkg:rpm/openEuler/nginx\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.0-15.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\u00a0\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with\u00a0ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file\u00a0directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)",
  "id": "OESA-2026-4545",
  "modified": "2026-10-29T09:02:46Z",
  "published": "2026-10-29T09:02:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4545"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15176"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93479"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97205"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97629"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nginx security update",
  "upstream": [
    "CVE-2026-15176",
    "CVE-2026-93479",
    "CVE-2026-97205",
    "CVE-2026-97629"
  ]
}

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "nginx-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-debuginfo-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-debugsource-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-mod-devel-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-mod-http-image-filter-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-mod-http-perl-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-mod-http-xslt-filter-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-mod-mail-1.24.0-15.oe2403sp4.aarch64.rpm",
          "nginx-mod-stream-1.24.0-15.oe2403sp4.aarch64.rpm"
        ],
        "noarch": [
          "nginx-all-modules-1.24.0-15.oe2403sp4.noarch.rpm",
          "nginx-filesystem-1.24.0-15.oe2403sp4.noarch.rpm",
          "nginx-help-1.24.0-15.oe2403sp4.noarch.rpm"
        ],
        "src": [
          "nginx-1.24.0-15.oe2403sp4.src.rpm"
        ],
        "x86_64": [
          "nginx-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-debuginfo-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-debugsource-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-mod-devel-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-mod-http-image-filter-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-mod-http-perl-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-mod-http-xslt-filter-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-mod-mail-1.24.0-15.oe2403sp4.x86_64.rpm",
          "nginx-mod-stream-1.24.0-15.oe2403sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP4",
        "name": "nginx",
        "purl": "pkg:rpm/openEuler/nginx\u0026distro=openEuler-24.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.24.0-15.oe2403sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "NGINX is a free, open-source, high-performance HTTP server and reverse proxy,  as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-15176)\n\nA vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map\u0026apos;s regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable in a string expression under certain conditions. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\u00a0\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only.\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-93479)\n\nNGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing \u201cinclude virtual\u201d commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.\n\nImpact:\nThis vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system, corrupt its memory, or possibly trigger code execution. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97205)\n\nDescription\nWhen NGINX Plus or NGINX Open Source is configured with\u00a0ssl_session_cache \n\nshared:name:size\n\nwithout an explicit ssl_session_ticket_key file\u00a0directives to automatically rotate SSL session ticket keys, a remote unauthenticated attacker is able to forge client SSL sessions \n\nin a non-deterministic manner that is beyond the attacker\u0026apos;s control. An attacker could leverage this vulnerability to bypass verification of client certificates.\n\nImpact\n\n\nThis vulnerability can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with access to sensitive information. There is no control plane exposure; this is a data plane issue only.\n\n\n\n\n\n\nNote: Software versions which have reached End of Technical Support (EoTS) are not evaluated.(CVE-2026-97629)",
  "id": "OESA-2026-4546",
  "modified": "2026-10-29T09:02:47Z",
  "published": "2026-10-29T09:02:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4546"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15176"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93479"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97205"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97629"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "nginx security update",
  "upstream": [
    "CVE-2026-15176",
    "CVE-2026-93479",
    "CVE-2026-97205",
    "CVE-2026-97629"
  ]
}