Read the docs
TI-2025-17186 Aliases CVE-2025-23419GHSA-84xh-pwc6-7g4g

TLS Session Resumption Vulnerability

Priority LOW 29CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 fixed, 4 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-863.

Summary

When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02795 86th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
F5NGINX Open Source1.11.4 and later—No fix listedCNA
F5NGINX PlusR17 and later—No fix listedCNA
  • NGINX Open Source VendorF5 Affected 1.11.4 and later Fixed in — No fix listed CNA
  • NGINX Plus VendorF5 Affected R17 and later Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*1.11.4 to before 1.26.3; 1.27.0 to before 1.27.4VulnerableF5
cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:*r28 to before r32VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:*r32VulnerableF5
cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:*r32 p1VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:-:*:*:*:*:*:*r33VulnerableF5
cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*r33 p1VulnerableF5
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
  • cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* Versions 1.11.4 to before 1.26.3; 1.27.0 to before 1.27.4 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:*:*:*:*:*:*:*:* Versions r28 to before r32 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:-:*:*:*:*:*:* Versions r32 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r32:p1:*:*:*:*:*:* Versions r32 p1 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:-:*:*:*:*:*:* Versions r33 Vulnerable ·F5
  • cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:* Versions r33 p1 Vulnerable ·F5
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian

Remediation

Red Hat 1 advisory

  • RHSA-2025:7331 Released 2025-05-13 · Red Hat rating Moderate
    nginx security update
    • Red Hat Enterprise Linux AppStream (v. 9) nginx-2:1.20.1-22.el9, nginx-all-modules-2:1.20.1-22.el9, nginx-core-2:1.20.1-22.el9 +6
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) nginx-mod-devel-2:1.20.1-22.el9

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 1.2AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Lightspeed proxy 1AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:7331
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:7331
Not affected: 2 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-23419
  2. 2026-10-03 Alias added: GHSA-84xh-pwc6-7g4g

References

Advisory 3

  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2013-01799 The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0… CVSS 2.0HIGH 7.5
  • TI-2016-00666 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to… CVSS 3.1HIGH 7.5
  • TI-2019-06948 Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a… CVSS 3.1HIGH 7.5
  • TI-2009-02513 Buffer underflow in src/http/ngx_http_parse.c in nginx 0.1.0 through 0.5.37, 0.6.x before… CVSS 2.0HIGH 7.5
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences