CVE-2026-28755
published 2026-03-24CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured…
PriorityP429medium5.4CVSS 3.1
AVNACLPRLUINSUCLILAN
EPSS
0.13%
3.2th percentile
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nginx | < nginx 1.28.3-2 (forky) | nginx 1.28.3-2 (forky) |
| f5 | nginx | >= 0 < 1.28.3-r0 | 1.28.3-r0 |
| f5 | nginx | >= 0 < 1.28.3-r0 | 1.28.3-r0 |
| f5 | nginx | >= 0 < 1.28.3-2 | 1.28.3-2 |
| f5 | nginx_open_source | — | — |
| f5 | nginx_open_source | 0.5.13 – 0.9.7 | — |
| f5 | nginx_open_source | >= 1.27.2 < 1.28.3 | 1.28.3 |
| f5 | nginx_open_source | >= 1.29.0 < 1.29.7 | 1.29.7 |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | — | — |
| f5 | nginx_plus | >= R33 < * | * |
| f5 | nginx_plus | >= R34 < * | * |
| f5 | nginx_plus | >= R35 < R35 P2 | R35 P2 |
| f5 | nginx_plus | >= R36 < R36 P3 | R36 P3 |
| msrc | azl3_nginx_1.28.2-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_nginx_1.22.1-15_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv5.3MEDIUM
vendor_msrc5.4MEDIUM
vendor_debian5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
vendor_redhat·2026-03-24·CVSS 5.3
CVE-2026-28755 [MEDIUM] CWE-295 NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
A flaw was found in NGINX, specifically within its `ngx_stream_ssl_module`. When NGINX is configured to verify client certificates and use the Online Certificate Status Protocol (OCSP) for revocation checks, it fails to properly enforce the revocation status. This allows a Transport Layer Security (TLS) handshake to co
F5
CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handlin...
vendor_f5·2026-03-24·CVSS 5.4
CVE-2026-28755 [MEDIUM] CWE-863 CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handlin...
CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handlin...
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Affected Products: NGINX Plus, Nginx Open Source
Affected Versions: 0.5.13 - 0.9.7; 1.27.2 - 1.28.3; 1.29.0 - 1.29.7; r33; r34; r35; r36
F5 Advisory Articles: K000160368
F5 References: https://my.f5.com/manage/s/article/K000160368
Microsoft
NGINX ngx_stream_ssl_module vulnerability
vendor_msrc·2026-03-10·CVSS 5.4
CVE-2026-28755 [MEDIUM] CWE-863 NGINX ngx_stream_ssl_module vulnerability
NGINX ngx_stream_ssl_module vulnerability
Mariner: Mariner
f5: f5
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2026-28755: nginx - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_modu...
vendor_debian·2026·CVSS 5.3
CVE-2026-28755 [MEDIUM] CVE-2026-28755: nginx - NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_modu...
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 1.28.3-2)
sid: resolved (fixed in 1.28.3-2)
trixie: open
VulDB
F5 NGINX Open Source/NGINX Plus ngx_stream_ssl_module authorization (K000160368 / Nessus ID 306672)
vuldb·2026-04-17·CVSS 5.3
CVE-2026-28755 [MEDIUM] F5 NGINX Open Source/NGINX Plus ngx_stream_ssl_module authorization (K000160368 / Nessus ID 306672)
A vulnerability classified as critical has been found in F5 NGINX Open Source and NGINX Plus. This issue affects the function ngx_stream_ssl_module. Performing a manipulation results in incorrect authorization.
This vulnerability is known as CVE-2026-28755. Remote exploitation of the attack is possible. No exploit is available.
It is recommended to upgrade the affected component.
OSV
CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co
osv·2026-03-24·CVSS 5.3
CVE-2026-28755 [MEDIUM] CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
GHSA
GHSA-hgfr-jmpr-2p89: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co
ghsa_unreviewed·2026-03-24
CVE-2026-28755 [MEDIUM] CWE-863 GHSA-hgfr-jmpr-2p89: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
OSV
CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co
osv·2026-03-24·CVSS 5.3
CVE-2026-28755 [MEDIUM] CVE-2026-28755: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when co
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-27651 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.7
CVE-2026-27651 [HIGH] CVE-2026-27651 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27651 :
NGINX vulnerability analysis and mitigation
When the ngx_mail_auth_http_module module is enabled on NGINX Plus or NGINX Open Source, undisclosed requests can cause worker processes to terminate. This issue may occur when (1) CRAM-MD5 or APOP authentication is enabled, and (2) the authentication server permits retry by returning the Auth-Wait response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.7
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.7
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 12.5
Exploitation Probability (EPSS) N/A
Affected
Wiz
CVE-2026-27784 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-27784 [HIGH] CVE-2026-27784 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27784 :
NGINX vulnerability analysis and mitigation
The 32-bit implementation of NGINX Open Source has a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to over-read or over-write NGINX worker memory resulting in its termination, using a specially crafted MP4 file. The issue only affects 32-bit NGINX Open Source if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.5
Score
Published March 24, 2026
Severity HIGH
CNA Score 8.
Wiz
CVE-2026-27654 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-27654 [HIGH] CVE-2026-27654 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-27654 :
NGINX vulnerability analysis and mitigation
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuration file uses DAV module MOVE or COPY methods, prefix location (nonregular expression location configuration), and alias directives. The integrity impact is constrained because the NGINX worker process user has low privileges and does not have access to the entire system. Note: Software versions which have reached End of Technical Sup
Wiz
CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2026-1642 [HIGH] CVE-2026-1642 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-1642 :
NGINX vulnerability analysis and mitigation
A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security (TLS) servers. An attacker with a man-in-the-middle (MITM) position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data into the response from an upstream proxied server. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.2
Score
Published February 4, 2026
Severity HIGH
CNA Score 8.2
Affected Technologies
NGINX
Rocky Linux
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 3.4
Exploitation
Wiz
CVE-2026-32647 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.5
CVE-2026-32647 [HIGH] CVE-2026-32647 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32647 :
NGINX vulnerability analysis and mitigation
NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_mp4_module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affects NGINX Open Source and NGINX Plus if it is built with the ngx_http_mp4_module module and the mp4 directive is used in the configuration file. Additionally, the attack is possible only if an attacker can trigger the processing of a specially crafted MP4 file with the ngx_http_mp4_module module.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 8.5
Score
Published M
Wiz
CVE-2026-28753 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-28753 [HIGH] CVE-2026-28753 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28753 :
NGINX vulnerability analysis and mitigation
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_mail_smtp_module module due to the improper handling of CRLF sequences in DNS responses. This allows an attacker-controlled DNS server to inject arbitrary headers into SMTP upstream requests, leading to potential request manipulation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 6.3
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 6.3
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 6.4
Exploitation Probability (EPSS) N/A
Affected packages and lib
Wiz
CVE-2026-28755 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.8
CVE-2026-28755 [HIGH] CVE-2026-28755 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-28755 :
NGINX vulnerability analysis and mitigation
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Source : NVD
## 5.3
Score
Published March 24, 2026
Severity MEDIUM
CNA Score 5.3
Affected Technologies
NGINX
Nginx Plus
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.5
Exploitation Probability (EPSS) N/A
Affec
Bugzilla
CVE-2026-28755 nginx: NGINX: Certificate revocation bypass when OCSP is enabled [fedora-all]
bugzilla·2026-03-24·CVSS 5.3
CVE-2026-28755 [MEDIUM] CVE-2026-28755 nginx: NGINX: Certificate revocation bypass when OCSP is enabled [fedora-all]
CVE-2026-28755 nginx: NGINX: Certificate revocation bypass when OCSP is enabled [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-4de4d247a0 (nginx-1.28.3-1.fc44, nginx-mod-brotli-1.0.0~rc-7.fc44, and 5 more) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-4de4d247a0
---
FEDORA-2026-4de4d247a0 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-4de4d247a0`
You can provide feedback
Bugzilla
CVE-2026-28755 NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
bugzilla·2026-03-24·CVSS 5.4
CVE-2026-28755 [MEDIUM] CVE-2026-28755 NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
CVE-2026-28755 NGINX: NGINX: Certificate revocation bypass when OCSP is enabled
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module due to the improper handling of revoked certificates when configured with ssl_verify_client on and ssl_ocsp on, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
2026-03-24
Published