CVE-2026-28755
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co...
Résumé
NGINX ngx_stream_ssl_module vulnerability
Description d'origine
La description telle que publiée par la source (souvent en anglais).
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Paquets affectés
Bitnami
nginx
[{"type":"SEMVER","events":[{"introduced":"1.27.2"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]
Bitnami
nginx-gateway
[{"type":"SEMVER","events":[{"introduced":"1.27.2"},{"fixed":"1.28.3"},{"introduced":"1.29.0"},{"fixed":"1.29.7"}]}]
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Alpine Linux ALPINE-CVE-2026-28755 nginx Corrigé dans: 1.28.3-r0
- Debian DEBIAN-CVE-2026-28755 nginx
Références
- advisory my.f5.com
- web nvd.nist.gov