CVE-2026-28755

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_stream_ssl_module module due to the improper handling of revoked certificates when configured with the ssl_verify_client on and ssl_ocsp on directives, allowing the TLS handshake to succeed even after an OCSP check identifies the certificate as revoked.

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

Database specific

{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:f5:nginx_plus:r33:*:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r33:p1:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r33:p2:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r33:p3:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r34:*:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r34:p1:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r34:p2:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r35:p1:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r36:*:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r36:p1:*:*:*:*:*:*",
                "cpe:2.3:a:f5:nginx_plus:r36:p2:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "r33"
                },
                {
                    "last_affected": "r33"
                },
                {
                    "introduced": "r33-p1"
                },
                {
                    "last_affected": "r33-p1"
                },
                {
                    "introduced": "r33-p2"
                },
                {
                    "last_affected": "r33-p2"
                },
                {
                    "introduced": "r33-p3"
                },
                {
                    "last_affected": "r33-p3"
                },
                {
                    "introduced": "r34"
                },
                {
                    "last_affected": "r34"
                },
                {
                    "introduced": "r34-p1"
                },
                {
                    "last_affected": "r34-p1"
                },
                {
                    "introduced": "r34-p2"
                },
                {
                    "last_affected": "r34-p2"
                },
                {
                    "introduced": "r35-p1"
                },
                {
                    "last_affected": "r35-p1"
                },
                {
                    "introduced": "r36"
                },
                {
                    "last_affected": "r36"
                },
                {
                    "introduced": "r36-p1"
                },
                {
                    "last_affected": "r36-p1"
                },
                {
                    "introduced": "r36-p2"
                },
                {
                    "last_affected": "r36-p2"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "f5:nginx_plus"
        }
    ]
}

References

https://my.f5.com/manage/s/article/K000160368

Affected packages

Git / github.com/nginx/nginx

Affected ranges

Type

GIT

Repo

https://github.com/nginx/nginx

Events

Introduced

ca1e78e0ceb1cd344bfc00647d0b167db602f298

Last Affected

955370fc8c12b1a945941f844adc9df49a0f3f32

Introduced

e24f7ccc161f1a2a759eb27263ec9af4fc7c8e96

Fixed

9b958b000776c88036cd800c66e7e4ad39e6fd41

Introduced

235f409907fd60eb2d8f6ecdc0e5cb163dd6d45f

Fixed

5ac6f49371f9fcdf21ca4b4fd2a8657576f0885b

Database specific

Show details

{
    "cpe": "cpe:2.3:a:f5:nginx_open_source:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.5.13"
        },
        {
            "last_affected": "0.9.7"
        },
        {
            "introduced": "1.27.2"
        },
        {
            "fixed": "1.28.3"
        },
        {
            "introduced": "1.29.0"
        },
        {
            "fixed": "1.29.7"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

release-0.*

release-0.5.13

release-0.5.14

release-0.5.15

release-0.5.16

release-0.5.17

release-0.5.18

release-0.5.19

release-0.5.20

release-0.5.21

release-0.5.22

release-0.5.23

release-0.5.24

release-0.5.25

release-0.6.0

release-0.6.1

release-0.6.10

release-0.6.11

release-0.6.12

release-0.6.13

release-0.6.14

release-0.6.15

release-0.6.16

release-0.6.17

release-0.6.18

release-0.6.19

release-0.6.2

release-0.6.20

release-0.6.21

release-0.6.22

release-0.6.23

release-0.6.24

release-0.6.25

release-0.6.26

release-0.6.27

release-0.6.28

release-0.6.29

release-0.6.3

release-0.6.30

release-0.6.31

release-0.6.4

release-0.6.5

release-0.6.6

release-0.6.7

release-0.6.8

release-0.6.9

release-0.7.0

release-0.7.1

release-0.7.10

release-0.7.11

release-0.7.12

release-0.7.13

release-0.7.14

release-0.7.15

release-0.7.16

release-0.7.17

release-0.7.18

release-0.7.19

release-0.7.2

release-0.7.20

release-0.7.21

release-0.7.22

release-0.7.23

release-0.7.24

release-0.7.25

release-0.7.26

release-0.7.27

release-0.7.28

release-0.7.29

release-0.7.3

release-0.7.30

release-0.7.31

release-0.7.32

release-0.7.33

release-0.7.34

release-0.7.35

release-0.7.36

release-0.7.37

release-0.7.38

release-0.7.39

release-0.7.4

release-0.7.40

release-0.7.41

release-0.7.42

release-0.7.43

release-0.7.44

release-0.7.45

release-0.7.46

release-0.7.47

release-0.7.48

release-0.7.49

release-0.7.5

release-0.7.50

release-0.7.51

release-0.7.52

release-0.7.53

release-0.7.54

release-0.7.55

release-0.7.56

release-0.7.57

release-0.7.58

release-0.7.59

release-0.7.6

release-0.7.7

release-0.7.8

release-0.7.9

release-0.8.0

release-0.8.1

release-0.8.10

release-0.8.11

release-0.8.12

release-0.8.13

release-0.8.14

release-0.8.15

release-0.8.16

release-0.8.17

release-0.8.18

release-0.8.19

release-0.8.2

release-0.8.20

release-0.8.21

release-0.8.22

release-0.8.23

release-0.8.24

release-0.8.25

release-0.8.26

release-0.8.27

release-0.8.28

release-0.8.29

release-0.8.3

release-0.8.30

release-0.8.31

release-0.8.32

release-0.8.33

release-0.8.34

release-0.8.35

release-0.8.36

release-0.8.37

release-0.8.38

release-0.8.39

release-0.8.4

release-0.8.40

release-0.8.41

release-0.8.42

release-0.8.43

release-0.8.44

release-0.8.45

release-0.8.46

release-0.8.47

release-0.8.48

release-0.8.49

release-0.8.5

release-0.8.50

release-0.8.51

release-0.8.52

release-0.8.53

release-0.8.6

release-0.8.7

release-0.8.8

release-0.8.9

release-0.9.0

release-0.9.1

release-0.9.2

release-0.9.3

release-0.9.4

release-0.9.5

release-0.9.6

release-0.9.7

release-1.*

release-1.27.2

release-1.27.3

release-1.27.4

release-1.27.5

release-1.28.0

release-1.28.1

release-1.28.2

release-1.29.0

release-1.29.1

release-1.29.2

release-1.29.3

release-1.29.4

release-1.29.5

release-1.29.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-28755.json"