CVE-2026-28755
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co...
Summary
NGINX ngx_stream_ssl_module vulnerability
Original description
The description as published by the source.
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected packages
Bitnami
nginx
[{"type":"SEMVER","events":[{"introduced":"1.27.2"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]
Bitnami
nginx-gateway
[{"type":"SEMVER","events":[{"introduced":"1.27.2"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2026-28755 nginx Fixed in: 1.28.3-r0
- Debian DEBIAN-CVE-2026-28755 nginx
References
- advisory my.f5.com
- web nvd.nist.gov