The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade nginx | Aug 8, 2025 | Feb 5, 2025 |
| Amazon Linux Ami 2 | — | Upgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-http-geoipUpgrade nginx-mod-mailUpgrade nginxUpgrade nginx-mod-http-perlUpgrade nginx-coreUpgrade nginx-mod-develUpgrade nginx-mod-streamUpgrade nginx-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-http-image-filter | Mar 27, 2025 | Feb 5, 2025 |
| Amazon_linux_2023 | — | Upgrade nginx-coreUpgrade nginx-core-debuginfoUpgrade nginx-mod-mail-debuginfoUpgrade nginxUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-all-modulesUpgrade nginx-filesystemUpgrade nginx-mod-http-image-filterUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-mailUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-develUpgrade nginx-mod-http-perlUpgrade nginx-debuginfoUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-debugsource | Feb 26, 2025 | Feb 5, 2025 |
| Debian | — | Upgrade nginx | Mar 17, 2025 | Feb 5, 2025 |
| Freebsd | — | Upgrade nginxUpgrade nginx-devel | Feb 6, 2025 | Feb 5, 2025 |
| Gentoo Linux | — | Upgrade www-servers/nginx. | Aug 17, 2026 | Aug 17, 2026 |
| Nginx | — | Upgrade to nginx version 1.27.4Upgrade to nginx version 1.26.3 | Feb 6, 2025 | Feb 5, 2025 |
| Oracle_linux | — | Upgrade nginx-filesystemUpgrade nginx-coreUpgrade nginx-mod-http-perlUpgrade nginx-all-modulesUpgrade nginx-mod-http-image-filterUpgrade nginxUpgrade nginx-mod-mailUpgrade nginx-mod-streamUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-devel | May 26, 2025 | Feb 5, 2025 |
| Redhat_linux | — | Upgrade nginx-mod-streamUpgrade nginx-mod-develUpgrade nginx-mod-http-image-filterUpgrade nginx-debugsourceUpgrade nginx-core-debuginfoNo solution existsUpgrade nginx-debuginfoUpgrade nginx-mod-http-image-filter-debuginfoUpgrade nginx-mod-http-xslt-filterUpgrade nginx-mod-stream-debuginfoUpgrade nginx-mod-http-xslt-filter-debuginfoUpgrade nginx-mod-http-perl-debuginfoUpgrade nginx-all-modulesUpgrade nginx-mod-mailUpgrade nginx-filesystemUpgrade nginx-mod-mail-debuginfoUpgrade nginx-coreUpgrade nginx-mod-http-perlUpgrade nginx | May 14, 2025 | Feb 5, 2025 |
| Suse | — | Upgrade nginx-sourceUpgrade nginx | Dec 5, 2025 | Jun 1, 2025 |
| Ubuntu | — | Upgrade nginx-fullUpgrade nginx-coreUpgrade nginx-commonUpgrade libnginx-mod-rtmpUpgrade nginx-docUpgrade nginx-extrasUpgrade nginx-devUpgrade nginxUpgrade nginx-light | Feb 25, 2025 | Feb 5, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 20, 2025 | Feb 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub